feat(spec): add optional valid-until to capability-request

spec/management.cddl

@@ -32,8 +32,15 @@ manage-response-frame = { type: "manage-response", request-id: uint, outcome: ma
 ; (freshly minted token on the same response) rather than inventing a new
 ; response frame; a denial is an ordinary manage-error, the same convention
 ; room.join's own denial already uses.
+; valid-until (wire-mesh#82) lets a requester bound how long its own ask is
+; worth granting -- a receiver refuses a request whose deadline has already
+; passed outright rather than presenting a stale ask to a human for
+; approval, and a future relay/facilitator forwarding the request can drop
+; it once expired rather than keep holding or forwarding it. Reuses the
+; same message/token-lifetime concept the plan's own section E already
+; names as its own open item, rather than inventing a second TTL field.
 $manage-command-params /= capability-request
-capability-request = { verb: "capability.request", capability: tstr, * tstr => any }
+capability-request = { verb: "capability.request", capability: tstr, ? valid-until: uint, * tstr => any }
 capability-grant-ok = { result: "ok", "granted-token": capability-token, * tstr => any }
 
 ; Revocation — new, not present in Cascade's frozen set. Gossiped revocation

spec/protocol.cddl

@@ -389,8 +389,15 @@ manage-response-frame = { type: "manage-response", request-id: uint, outcome: ma
 ; (freshly minted token on the same response) rather than inventing a new
 ; response frame; a denial is an ordinary manage-error, the same convention
 ; room.join's own denial already uses.
+; valid-until (wire-mesh#82) lets a requester bound how long its own ask is
+; worth granting -- a receiver refuses a request whose deadline has already
+; passed outright rather than presenting a stale ask to a human for
+; approval, and a future relay/facilitator forwarding the request can drop
+; it once expired rather than keep holding or forwarding it. Reuses the
+; same message/token-lifetime concept the plan's own section E already
+; names as its own open item, rather than inventing a second TTL field.
 $manage-command-params /= capability-request
-capability-request = { verb: "capability.request", capability: tstr, * tstr => any }
+capability-request = { verb: "capability.request", capability: tstr, ? valid-until: uint, * tstr => any }
 capability-grant-ok = { result: "ok", "granted-token": capability-token, * tstr => any }
 
 ; Revocation — new, not present in Cascade's frozen set. Gossiped revocation

ts/packages/core/src/generated/protocol.ts

@@ -136,6 +136,7 @@ export const manageResponseFrameSchema = z.lazy(() => z.object({
 export const capabilityRequestSchema = z.lazy(() => z.object({
   "verb": z.literal("capability.request"),
   "capability": z.string(),
+  "valid-until": z.number().int().nonnegative().optional(),
 }).catchall(z.unknown()));
 export const capabilityGrantOkSchema = z.lazy(() => z.object({
   "result": z.literal("ok"),