@makaio/framework 1.0.0-dev-1784889676396 → 1.0.0-dev-1785344643235

package/dist/{namespace-CriPb5wY.d.mts → namespace-jPUGV-b2.d.mts}

@@ -88,7 +88,7 @@ declare const SessionStorageNamespace$1: {
             tableName: "sessions";
             dataType: "string";
             columnType: "SQLiteText";
-            data: "closed" | "discovered" | "active" | "archived";
+            data: "discovered" | "closed" | "active" | "archived";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -202,7 +202,7 @@ declare const SessionStorageNamespace$1: {
             tableName: "sessions";
             dataType: "string";
             columnType: "SQLiteText";
-            data: "fork" | "subagent" | "branch" | "compress" | "rewrite" | "coordinator" | "aside";
+            data: "fork" | "branch" | "subagent" | "compress" | "rewrite" | "coordinator" | "aside";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -1057,8 +1057,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -1072,8 +1072,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -1179,8 +1179,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -1194,8 +1194,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -1278,8 +1278,8 @@ declare const SessionStorageNamespace$1: {
       request: _$zod.ZodObject<{
         status: _$zod.ZodOptional<_$zod.ZodEnum<{
           all: "all";
-          closed: "closed";
           discovered: "discovered";
+          closed: "closed";
           active: "active";
           archived: "archived";
         }>>;
@@ -1326,8 +1326,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -1341,8 +1341,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -1424,8 +1424,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodNullable<_$zod.ZodString>;
           branchKind: _$zod.ZodNullable<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -1443,8 +1443,8 @@ declare const SessionStorageNamespace$1: {
         limit: _$zod.ZodOptional<_$zod.ZodNumber>;
         status: _$zod.ZodOptional<_$zod.ZodEnum<{
           all: "all";
-          closed: "closed";
           discovered: "discovered";
+          closed: "closed";
           active: "active";
           archived: "archived";
         }>>;
@@ -1488,8 +1488,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -1503,8 +1503,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -1579,8 +1579,8 @@ declare const SessionStorageNamespace$1: {
       request: _$zod.ZodObject<{
         sessionId: _$zod.ZodString;
         status: _$zod.ZodOptional<_$zod.ZodEnum<{
-          closed: "closed";
           discovered: "discovered";
+          closed: "closed";
           active: "active";
           archived: "archived";
         }>>;
@@ -1593,8 +1593,8 @@ declare const SessionStorageNamespace$1: {
         forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
         branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
           fork: "fork";
-          subagent: "subagent";
           branch: "branch";
+          subagent: "subagent";
           compress: "compress";
           rewrite: "rewrite";
           coordinator: "coordinator";
@@ -1673,8 +1673,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -1688,8 +1688,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -1930,8 +1930,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -1945,8 +1945,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -2059,8 +2059,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -2074,8 +2074,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -2209,8 +2209,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -2224,8 +2224,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -2331,8 +2331,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -2346,8 +2346,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -2430,8 +2430,8 @@ declare const SessionStorageNamespace$1: {
       request: _$zod.ZodObject<{
         status: _$zod.ZodOptional<_$zod.ZodEnum<{
           all: "all";
-          closed: "closed";
           discovered: "discovered";
+          closed: "closed";
           active: "active";
           archived: "archived";
         }>>;
@@ -2478,8 +2478,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -2493,8 +2493,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -2576,8 +2576,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodNullable<_$zod.ZodString>;
           branchKind: _$zod.ZodNullable<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -2595,8 +2595,8 @@ declare const SessionStorageNamespace$1: {
         limit: _$zod.ZodOptional<_$zod.ZodNumber>;
         status: _$zod.ZodOptional<_$zod.ZodEnum<{
           all: "all";
-          closed: "closed";
           discovered: "discovered";
+          closed: "closed";
           active: "active";
           archived: "archived";
         }>>;
@@ -2640,8 +2640,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -2655,8 +2655,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -2731,8 +2731,8 @@ declare const SessionStorageNamespace$1: {
       request: _$zod.ZodObject<{
         sessionId: _$zod.ZodString;
         status: _$zod.ZodOptional<_$zod.ZodEnum<{
-          closed: "closed";
           discovered: "discovered";
+          closed: "closed";
           active: "active";
           archived: "archived";
         }>>;
@@ -2745,8 +2745,8 @@ declare const SessionStorageNamespace$1: {
         forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
         branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
           fork: "fork";
-          subagent: "subagent";
           branch: "branch";
+          subagent: "subagent";
           compress: "compress";
           rewrite: "rewrite";
           coordinator: "coordinator";
@@ -2825,8 +2825,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -2840,8 +2840,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -3082,8 +3082,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -3097,8 +3097,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -3211,8 +3211,8 @@ declare const SessionStorageNamespace$1: {
             lastActivityAt: _$zod.ZodNumber;
           }, _$zod_v4_core0.$strip>>;
           status: _$zod.ZodEnum<{
-            closed: "closed";
             discovered: "discovered";
+            closed: "closed";
             active: "active";
             archived: "archived";
           }>;
@@ -3226,8 +3226,8 @@ declare const SessionStorageNamespace$1: {
           forkPointMessageId: _$zod.ZodOptional<_$zod.ZodString>;
           branchKind: _$zod.ZodOptional<_$zod.ZodEnum<{
             fork: "fork";
-            subagent: "subagent";
             branch: "branch";
+            subagent: "subagent";
             compress: "compress";
             rewrite: "rewrite";
             coordinator: "coordinator";
@@ -3351,13 +3351,13 @@ declare const SessionStorageNamespace$1: {
         clientId?: string | undefined;
         compressionMode?: "auto" | "manual" | "off" | undefined;
       }[];
-      status: "closed" | "discovered" | "active" | "archived";
+      status: "discovered" | "closed" | "active" | "archived";
       leadAgentId?: string | undefined;
       parentSessionId?: string | undefined;
       contextInheritance?: "none" | "parent-history" | undefined;
       rootSessionId?: string | undefined;
       forkPointMessageId?: string | undefined;
-      branchKind?: "fork" | "subagent" | "branch" | "compress" | "rewrite" | "coordinator" | "aside" | undefined;
+      branchKind?: "fork" | "branch" | "subagent" | "compress" | "rewrite" | "coordinator" | "aside" | undefined;
       adapterName?: string | undefined;
       adapterSessionId?: string | undefined;
       adapterId?: string | undefined;

package/dist/{native-session-supervisor-Bgz-Q1WH.mjs → native-session-supervisor-DRx0MX-d.mjs}

@@ -1 +1 @@
-import{r as e}from"./profile-BRi6K6am.mjs";import{z as t}from"zod";import{createBusNamespace as n}from"@makaio/framework/core";const r=t.enum([`running`,`stopped`,`exited`,`unknown`]),i={request:t.object({clientId:t.string(),cwd:t.string(),command:t.string(),args:t.array(t.string()),env:t.record(t.string(),t.string()).optional(),sessionId:t.string().optional(),clientProfileName:e.optional(),adapterSessionId:t.string().optional(),metadata:t.record(t.string(),t.unknown()).optional()}),response:t.object({supervisorSessionId:t.string(),pid:t.number().int().positive()})},a={request:t.union([t.object({supervisorSessionId:t.string()}).strict(),t.object({sessionId:t.string()}).strict(),t.object({adapterSessionId:t.string()}).strict()]),response:t.object({success:t.boolean(),supervisorSessionId:t.string().optional(),pid:t.number().int().positive().optional(),terminalAttachment:t.object({canAttach:t.boolean()}).optional()})},o={request:t.object({supervisorSessionId:t.string(),signal:t.string().optional()}),response:t.object({success:t.boolean()})},s=t.object({supervisorSessionId:t.string(),clientId:t.string(),pid:t.number().int().positive().nullable(),status:r,cwd:t.string(),sessionId:t.string().optional(),adapterSessionId:t.string().optional(),startedAt:t.number().int().nonnegative(),stoppedAt:t.number().int().nonnegative().optional()}),c={request:t.union([t.object({}).strict(),t.object({supervisorSessionId:t.string()}).strict(),t.object({sessionId:t.string()}).strict(),t.object({adapterSessionId:t.string()}).strict()]),response:t.object({runtimes:t.array(s)})},l={launch:i,attach:a,stop:o,status:c},u=n(`native-session-supervisor`,l),d=u.subjects;export{i as a,s as c,a as i,r as l,d as n,c as o,l as r,o as s,u as t};
+import{r as e}from"./profile-BTAI31Nt.mjs";import{z as t}from"zod";import{createBusNamespace as n}from"@makaio/framework/core";const r=t.enum([`running`,`stopped`,`exited`,`unknown`]),i={request:t.object({clientId:t.string(),cwd:t.string(),command:t.string(),args:t.array(t.string()),env:t.record(t.string(),t.string()).optional(),sessionId:t.string().optional(),clientProfileName:e.optional(),adapterSessionId:t.string().optional(),metadata:t.record(t.string(),t.unknown()).optional()}),response:t.object({supervisorSessionId:t.string(),pid:t.number().int().positive()})},a={request:t.union([t.object({supervisorSessionId:t.string()}).strict(),t.object({sessionId:t.string()}).strict(),t.object({adapterSessionId:t.string()}).strict()]),response:t.object({success:t.boolean(),supervisorSessionId:t.string().optional(),pid:t.number().int().positive().optional(),terminalAttachment:t.object({canAttach:t.boolean()}).optional()})},o={request:t.object({supervisorSessionId:t.string(),signal:t.string().optional()}),response:t.object({success:t.boolean()})},s=t.object({supervisorSessionId:t.string(),clientId:t.string(),pid:t.number().int().positive().nullable(),status:r,cwd:t.string(),sessionId:t.string().optional(),adapterSessionId:t.string().optional(),startedAt:t.number().int().nonnegative(),stoppedAt:t.number().int().nonnegative().optional()}),c={request:t.union([t.object({}).strict(),t.object({supervisorSessionId:t.string()}).strict(),t.object({sessionId:t.string()}).strict(),t.object({adapterSessionId:t.string()}).strict()]),response:t.object({runtimes:t.array(s)})},l={launch:i,attach:a,stop:o,status:c},u=n(`native-session-supervisor`,l),d=u.subjects;export{i as a,s as c,a as i,r as l,d as n,c as o,l as r,o as s,u as t};

package/dist/node/bus-server/index.d.mts

@@ -1,4 +1,4 @@
-import { i as BusServerConfig, n as startBusServer, r as BusServer, t as StartBusServerOptions } from "../../server-lifecycle-C-3OgoKi.mjs";
+import { i as BusServerConfig, n as startBusServer, r as BusServer, t as StartBusServerOptions } from "../../server-lifecycle-Dsq56aqC.mjs";
 import { BusBroadcastMessage, BusMessage, BusRequestMessage, BusTransport, BusTransportError } from "@makaio/framework/bus";
 import { TransportAuth, WebSocketLike, WebSocketServerLike, WebSocketServerLike as WebSocketServerLike$1 } from "@makaio/framework/node/transports";
 

package/dist/node/bus-server/index.mjs

@@ -1 +1 @@
-import{n as e,r as t,t as n}from"../../server-lifecycle-DV6NMsgH.mjs";var r=class{connectionListeners=new Set;on(e,t){e===`connection`&&this.connectionListeners.add(t)}off(e,t){e===`connection`&&this.connectionListeners.delete(t)}close(e){this.connectionListeners.clear(),e?.()}accept(e){for(let t of this.connectionListeners)t(e)}};export{r as HonoWebSocketBridge,t as LoopbackTransport,e as createBusServer,n as startBusServer};
+import{n as e,r as t,t as n}from"../../server-lifecycle-kmQ5PUDv.mjs";var r=class{connectionListeners=new Set;on(e,t){e===`connection`&&this.connectionListeners.add(t)}off(e,t){e===`connection`&&this.connectionListeners.delete(t)}close(e){this.connectionListeners.clear(),e?.()}accept(e){for(let t of this.connectionListeners)t(e)}};export{r as HonoWebSocketBridge,t as LoopbackTransport,e as createBusServer,n as startBusServer};

package/dist/node/bus-server/server-lifecycle.d.mts

@@ -1,2 +1,2 @@
-import { n as startBusServer, t as StartBusServerOptions } from "../../server-lifecycle-C-3OgoKi.mjs";
+import { n as startBusServer, t as StartBusServerOptions } from "../../server-lifecycle-Dsq56aqC.mjs";
 export { StartBusServerOptions, startBusServer };

package/dist/node/bus-server/server-lifecycle.mjs

@@ -1 +1 @@
-import{t as e}from"../../server-lifecycle-DV6NMsgH.mjs";export{e as startBusServer};
+import{t as e}from"../../server-lifecycle-kmQ5PUDv.mjs";export{e as startBusServer};

package/dist/node/transports/index.d.mts

@@ -135,9 +135,10 @@ interface HmacAuthOptions {
   /**
    * Server-side peer context resolver for identity-bound mode.
    *
-   * When provided, the authenticated identity is exposed to bus handlers as
-   * this peer context instead of the backward-compatible `workflow-execution`
-   * default. Return `null` when no peer context should be exposed.
+   * Authenticated identities are exposed to bus handlers only through this
+   * trusted resolver. Omitting it authenticates the socket without inventing
+   * authorization semantics from the caller-controlled identity ID. Return
+   * `null` when no peer context should be exposed.
    * @param claimedId - The authenticated `identityId`.
    * @returns Trusted peer context for the authenticated identity, or `null`.
    */
@@ -179,6 +180,14 @@ declare class HmacAuth implements TransportAuth {
    * Cleaned up in `cleanupSocket()` when the socket disconnects.
    */
   private serverAuthenticatedPeers;
+  /**
+   * Maps each identity-bound socket to the secret it authenticated with.
+   *
+   * Used by {@link isSocketAuthenticated} to detect secret rotation: when the
+   * registry now holds a different secret for the same identity, the socket is
+   * fenced because its handshake credential is stale.
+   */
+  private serverAuthenticatedSecrets;
   constructor(options: HmacAuthOptions);
   /**
    * Server-side authentication flow.
@@ -328,11 +337,25 @@ declare class HmacAuth implements TransportAuth {
 interface HmacIdentitySecretRegistrationOptions {
   /**
    * Trusted peer kind exposed after this identity authenticates.
+   */
+  readonly peerKind: string;
+  /**
+   * Opaque claims attached to the authenticated peer context.
    *
-   * Defaults to `workflow-execution` because the original identity-bound HMAC
-   * clients are workflow runners.
+   * Bus handlers can read `ctx.transport.peer.claims` to access these values
+   * without parsing the identity ID itself.
    */
-  readonly peerKind?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+  /**
+   * Optional subject restriction list for this identity.
+   *
+   * When provided, the server message handler rejects any inbound request,
+   * event, or broadcast whose full subject (`namespace.subject`) is not in
+   * this list. Identities without this field are unrestricted.
+   *
+   * Exact string match only; no wildcard support.
+   */
+  readonly allowedSubjects?: readonly string[];
 }
 /**
  * Register an HMAC secret for a transport identity.
@@ -342,10 +365,40 @@ interface HmacIdentitySecretRegistrationOptions {
  * accidentally undone by an older cleanup handle.
  * @param identityId - Transport identity that may authenticate with the secret.
  * @param secret - HMAC secret expected for the identity.
- * @param options - Optional trusted peer metadata for this identity.
+ * @param options - Trusted peer metadata for this identity.
  * @returns Cleanup function that unregisters this exact secret.
  */
-declare function registerHmacIdentitySecret(identityId: string, secret: string, options?: HmacIdentitySecretRegistrationOptions): () => void;
+declare function registerHmacIdentitySecret(identityId: string, secret: string, options: HmacIdentitySecretRegistrationOptions): () => void;
+/** Options for rotating an existing HMAC identity secret. */
+interface HmacIdentitySecretRotationOptions {
+  /**
+   * Override opaque claims attached to the authenticated peer context.
+   *
+   * When omitted the existing claims from the current registration are
+   * preserved. Provide explicitly to change claims during rotation.
+   */
+  readonly claims?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Rotate the HMAC secret for an already-registered transport identity.
+ *
+ * This is an explicit, intentional operation — it requires an existing
+ * registration for `identityId` and replaces the secret atomically. Per-message
+ * revalidation in {@link HmacAuth.isSocketAuthenticated} detects the new
+ * registration object and fences any socket that authenticated under the
+ * previous secret.
+ *
+ * The returned cleanup removes the entry only when it still points at the
+ * rotated registration object, so a stale cleanup from a prior registration
+ * cannot accidentally revoke the rotated secret.
+ * @param identityId - Transport identity whose secret should be rotated.
+ * @param newSecret - Replacement HMAC secret.
+ * @param options - Optional claim overrides for the rotated registration.
+ * @returns Cleanup function that unregisters this exact rotated secret.
+ * @throws Error when no registration exists for `identityId`.
+ * @throws Error when `newSecret` is empty.
+ */
+declare function rotateHmacIdentitySecret(identityId: string, newSecret: string, options?: HmacIdentitySecretRotationOptions): () => void;
 /**
  * Resolve an HMAC secret for an identity claim.
  * @param identityId - Claimed transport identity.
@@ -358,6 +411,25 @@ declare function resolveHmacIdentitySecret(identityId: string): string | null;
  * @returns Registered peer context, or null when the identity is unknown.
  */
 declare function resolveHmacIdentityPeer(identityId: string): TransportPeerContext | null;
+/**
+ * Resolve the subject restriction set for an identity claim.
+ *
+ * Returns the allowed subjects set when the identity has a subject
+ * restriction, or `null` when the identity is unrestricted or unknown.
+ * @param identityId - Claimed transport identity.
+ * @returns Allowed subjects set, or null when unrestricted/unknown.
+ */
+declare function resolveHmacIdentityAllowedSubjects(identityId: string): ReadonlySet<string> | null;
+/**
+ * Add exact subjects to an existing restricted HMAC identity without rotating
+ * its secret or replacing its peer metadata.
+ *
+ * The stored set is resolved for every inbound message, so an already
+ * authenticated WebSocket observes this update without reconnecting.
+ * @param identityId - Registered transport identity to update.
+ * @param subjects - Exact full subjects to add to the existing restriction.
+ * @throws When the identity is unknown or unrestricted.
+ */
 /**
  * Clear all registered identity secrets.
  *
@@ -2009,4 +2081,4 @@ declare module '@makaio/framework/bus' {
   }
 }
 //#endregion
-export { type ClientTransportCodec, DispatchingAuth, E2EAuth, E2ERelayAuth, type E2ERelayAuthOptions, HmacAuth, type HmacIdentitySecretRegistrationOptions, type RelayControlBusMessage, type RelayControlEnvelopeMessage, type RelayControlHelpers, type RelayControlRegistry, ServerTransport, type TransportAuth, WebSocketClientTransport, type WebSocketClientTransportHeartbeatOptions, type WebSocketClientTransportOptions, type WebSocketClientTransportReconnectOptions, type WebSocketCloseEvent, type WebSocketLike, type WebSocketServerLike, clearHmacIdentitySecretsForTesting, createE2EClientTransport, createE2ERelayClientTransport, createE2ERelayCodec, createRelayControlHelpers, createRelayControlRegistry, createWebSocketCloseEvent, createWebSocketTransport, index_d_exports as crypto, extractSocketErrorMessage, registerHmacIdentitySecret, resolveHmacIdentityPeer, resolveHmacIdentitySecret };
+export { type ClientTransportCodec, DispatchingAuth, E2EAuth, E2ERelayAuth, type E2ERelayAuthOptions, HmacAuth, type HmacIdentitySecretRegistrationOptions, type HmacIdentitySecretRotationOptions, type RelayControlBusMessage, type RelayControlEnvelopeMessage, type RelayControlHelpers, type RelayControlRegistry, ServerTransport, type TransportAuth, WebSocketClientTransport, type WebSocketClientTransportHeartbeatOptions, type WebSocketClientTransportOptions, type WebSocketClientTransportReconnectOptions, type WebSocketCloseEvent, type WebSocketLike, type WebSocketServerLike, clearHmacIdentitySecretsForTesting, createE2EClientTransport, createE2ERelayClientTransport, createE2ERelayCodec, createRelayControlHelpers, createRelayControlRegistry, createWebSocketCloseEvent, createWebSocketTransport, index_d_exports as crypto, extractSocketErrorMessage, registerHmacIdentitySecret, resolveHmacIdentityAllowedSubjects, resolveHmacIdentityPeer, resolveHmacIdentitySecret, rotateHmacIdentitySecret };