@peers-app/peers-sdk 0.23.14 → 0.24.0

package/dist/device-pairing/types.d.ts

@@ -1,52 +1,108 @@
 import { z } from "zod";
-/** A random 128-bit pairing-room identifier encoded as unpadded base64url. */
-export declare const pairingRoomIdSchema: z.ZodString;
-/** A random 256-bit pairing-room secret encoded as unpadded base64url. */
-export declare const pairingRoomSecretSchema: z.ZodString;
-/** A SHA-256 value encoded as unpadded base64url. */
+/** A SHA-256 value or 256-bit key encoded as unpadded base64url. */
 export declare const pairingHashSchema: z.ZodString;
 /** A random 256-bit endpoint nonce encoded as unpadded base64url. */
 export declare const pairingEndpointNonceSchema: z.ZodString;
+/** A 32-byte X25519 PAKE public share encoded as unpadded base64url. */
+export declare const pairingPakeShareSchema: z.ZodString;
+/** Small integer that names a signaling room; the first element of a pairing code. */
+export declare const pairingNameplateSchema: z.ZodNumber;
 /** Source and destination roles in a two-party pairing room. */
 export declare const pairingRoleSchema: z.ZodEnum<["source", "destination"]>;
 /** Source or destination role in a two-party pairing room. */
 export type PairingRole = z.infer<typeof pairingRoleSchema>;
-/** Versioned invitation shared out-of-band from the signed-in source. */
-export declare const devicePairingInvitationSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
-    roomSecret: z.ZodString;
-    expiresAt: z.ZodNumber;
+/** HTTP(S) origin of the signaling service without a path. */
+export declare const pairingServiceOriginSchema: z.ZodEffects<z.ZodString, string, string>;
+/** Established rendezvous shared by both endpoints once the room exists. */
+export declare const pairingRendezvousSchema: z.ZodObject<{
+    version: z.ZodLiteral<3>;
     serviceOrigin: z.ZodEffects<z.ZodString, string, string>;
+    nameplate: z.ZodNumber;
+    expiresAt: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
+    version: 3;
     expiresAt: number;
-    roomId: string;
-    roomSecret: string;
     serviceOrigin: string;
+    nameplate: number;
 }, {
-    version: 1;
+    version: 3;
     expiresAt: number;
-    roomId: string;
-    roomSecret: string;
     serviceOrigin: string;
+    nameplate: number;
 }>;
-/** Parsed device-pairing invitation. */
-export type DevicePairingInvitation = z.infer<typeof devicePairingInvitationSchema>;
+/** Established rendezvous shared by both endpoints once the room exists. */
+export type PairingRendezvous = z.infer<typeof pairingRendezvousSchema>;
 /** WebRTC session description carried inside an authenticated signaling message. */
 export declare const pairingSessionDescriptionSchema: z.ZodObject<{
     type: z.ZodEnum<["offer", "answer"]>;
     sdp: z.ZodString;
-    endpointNonce: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     type: "answer" | "offer";
     sdp: string;
-    endpointNonce: string;
 }, {
     type: "answer" | "offer";
     sdp: string;
+}>;
+/** Data transports a pairing ceremony can negotiate after the PAKE. */
+export declare const pairingTransportSchema: z.ZodEnum<["wrtc", "ws"]>;
+/** Data transport a pairing ceremony negotiated: a scoped WebRTC peer or a direct WebSocket. */
+export type PairingTransport = z.infer<typeof pairingTransportSchema>;
+/** Socket.IO URL a destination hosts for the direct WebSocket transport. */
+export declare const pairingWebSocketUrlSchema: z.ZodEffects<z.ZodString, string, string>;
+/**
+ * Destination's transport options, sent right after both PAKE shares. `websocket.urls` are the
+ * Socket.IO origins the destination is listening on for a source that can reach them directly.
+ */
+export declare const pairingTransportOptionsSchema: z.ZodObject<{
+    endpointNonce: z.ZodString;
+    webrtc: z.ZodBoolean;
+    websocket: z.ZodOptional<z.ZodObject<{
+        urls: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        urls: string[];
+    }, {
+        urls: string[];
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    webrtc: boolean;
     endpointNonce: string;
+    websocket?: {
+        urls: string[];
+    } | undefined;
+}, {
+    webrtc: boolean;
+    endpointNonce: string;
+    websocket?: {
+        urls: string[];
+    } | undefined;
 }>;
+/** Destination's advertised transport options. */
+export type PairingTransportOptions = z.infer<typeof pairingTransportOptionsSchema>;
+/** Source's transport choice; `url` is the destination URL it connected to for `ws`. */
+export declare const pairingTransportChoiceSchema: z.ZodDiscriminatedUnion<"selected", [z.ZodObject<{
+    endpointNonce: z.ZodString;
+    selected: z.ZodLiteral<"wrtc">;
+}, "strict", z.ZodTypeAny, {
+    endpointNonce: string;
+    selected: "wrtc";
+}, {
+    endpointNonce: string;
+    selected: "wrtc";
+}>, z.ZodObject<{
+    endpointNonce: z.ZodString;
+    selected: z.ZodLiteral<"ws">;
+    url: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    url: string;
+    endpointNonce: string;
+    selected: "ws";
+}, {
+    url: string;
+    endpointNonce: string;
+    selected: "ws";
+}>]>;
+/** Source's transport choice. */
+export type PairingTransportChoice = z.infer<typeof pairingTransportChoiceSchema>;
 /** ICE candidate carried inside an authenticated signaling message. */
 export declare const pairingIceCandidateSchema: z.ZodObject<{
     candidate: z.ZodString;
@@ -90,90 +146,231 @@ export declare const pairingIceServerSchema: z.ZodEffects<z.ZodObject<{
 }>;
 /** ICE server configuration safe to pass to a scoped pairing peer. */
 export type PairingIceServer = z.infer<typeof pairingIceServerSchema>;
-/** Unsigned offer, answer, or ICE message before its signaling MAC is attached. */
+/** PAKE share exchanged before any key exists; it is not MACed and carries no secrets. */
+export declare const pairingPakeSignalSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"pake">;
+    payload: z.ZodObject<{
+        share: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        share: string;
+    }, {
+        share: string;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "pake";
+    payload: {
+        share: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}, {
+    sequence: number;
+    version: 3;
+    kind: "pake";
+    payload: {
+        share: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}>;
+/** PAKE share signaling message. */
+export type PairingPakeSignal = z.infer<typeof pairingPakeSignalSchema>;
+/**
+ * Unsigned transport, offer, answer, or ICE message before its signaling MAC is attached.
+ *
+ * Order after both PAKE shares: destination `transport-options`, source `transport-choice`, then
+ * (WebRTC only) source `offer`, destination `answer`, and `candidate`s from either role.
+ */
 export declare const unsignedPairingSignalSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"transport-options">;
+    payload: z.ZodObject<{
+        endpointNonce: z.ZodString;
+        webrtc: z.ZodBoolean;
+        websocket: z.ZodOptional<z.ZodObject<{
+            urls: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            urls: string[];
+        }, {
+            urls: string[];
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    }, {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "transport-options";
+    payload: {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}, {
+    sequence: number;
+    version: 3;
+    kind: "transport-options";
+    payload: {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"transport-choice">;
+    payload: z.ZodDiscriminatedUnion<"selected", [z.ZodObject<{
+        endpointNonce: z.ZodString;
+        selected: z.ZodLiteral<"wrtc">;
+    }, "strict", z.ZodTypeAny, {
+        endpointNonce: string;
+        selected: "wrtc";
+    }, {
+        endpointNonce: string;
+        selected: "wrtc";
+    }>, z.ZodObject<{
+        endpointNonce: z.ZodString;
+        selected: z.ZodLiteral<"ws">;
+        url: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    }, {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    }>]>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "transport-choice";
+    payload: {
+        endpointNonce: string;
+        selected: "wrtc";
+    } | {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}, {
+    sequence: number;
+    version: 3;
+    kind: "transport-choice";
+    payload: {
+        endpointNonce: string;
+        selected: "wrtc";
+    } | {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}>, z.ZodObject<{
     kind: z.ZodLiteral<"offer">;
     payload: z.ZodObject<{
         sdp: z.ZodString;
-        endpointNonce: z.ZodString;
     } & {
         type: z.ZodLiteral<"offer">;
     }, "strict", z.ZodTypeAny, {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     }, {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     }>;
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
     senderRole: z.ZodEnum<["source", "destination"]>;
     sequence: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "offer";
-    roomId: string;
     payload: {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
 }, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "offer";
-    roomId: string;
     payload: {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"answer">;
     payload: z.ZodObject<{
         sdp: z.ZodString;
-        endpointNonce: z.ZodString;
     } & {
         type: z.ZodLiteral<"answer">;
     }, "strict", z.ZodTypeAny, {
         type: "answer";
         sdp: string;
-        endpointNonce: string;
     }, {
         type: "answer";
         sdp: string;
-        endpointNonce: string;
     }>;
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
     senderRole: z.ZodEnum<["source", "destination"]>;
     sequence: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "answer";
-    roomId: string;
     payload: {
         type: "answer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
 }, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "answer";
-    roomId: string;
     payload: {
         type: "answer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"candidate">;
@@ -193,126 +390,523 @@ export declare const unsignedPairingSignalSchema: z.ZodDiscriminatedUnion<"kind"
         sdpMLineIndex?: number | null | undefined;
         usernameFragment?: string | null | undefined;
     }>;
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
     senderRole: z.ZodEnum<["source", "destination"]>;
     sequence: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "candidate";
-    roomId: string;
     payload: {
         candidate: string;
         sdpMid?: string | null | undefined;
         sdpMLineIndex?: number | null | undefined;
         usernameFragment?: string | null | undefined;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
 }, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "candidate";
-    roomId: string;
     payload: {
         candidate: string;
         sdpMid?: string | null | undefined;
         sdpMLineIndex?: number | null | undefined;
         usernameFragment?: string | null | undefined;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
 }>]>;
 /** Signaling message contents before authentication. */
 export type UnsignedPairingSignal = z.infer<typeof unsignedPairingSignalSchema>;
-/** HMAC-authenticated offer, answer, or ICE signaling message. */
-export declare const pairingSignalSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+/** HMAC-authenticated transport, offer, answer, or ICE signaling message. */
+export declare const authenticatedPairingSignalSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"transport-options">;
+    payload: z.ZodObject<{
+        endpointNonce: z.ZodString;
+        webrtc: z.ZodBoolean;
+        websocket: z.ZodOptional<z.ZodObject<{
+            urls: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            urls: string[];
+        }, {
+            urls: string[];
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    }, {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "transport-options";
+    payload: {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}, {
+    sequence: number;
+    version: 3;
+    kind: "transport-options";
+    payload: {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"transport-choice">;
+    payload: z.ZodDiscriminatedUnion<"selected", [z.ZodObject<{
+        endpointNonce: z.ZodString;
+        selected: z.ZodLiteral<"wrtc">;
+    }, "strict", z.ZodTypeAny, {
+        endpointNonce: string;
+        selected: "wrtc";
+    }, {
+        endpointNonce: string;
+        selected: "wrtc";
+    }>, z.ZodObject<{
+        endpointNonce: z.ZodString;
+        selected: z.ZodLiteral<"ws">;
+        url: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    }, {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    }>]>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "transport-choice";
+    payload: {
+        endpointNonce: string;
+        selected: "wrtc";
+    } | {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}, {
+    sequence: number;
+    version: 3;
+    kind: "transport-choice";
+    payload: {
+        endpointNonce: string;
+        selected: "wrtc";
+    } | {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}>, z.ZodObject<{
     kind: z.ZodLiteral<"offer">;
     payload: z.ZodObject<{
         sdp: z.ZodString;
-        endpointNonce: z.ZodString;
     } & {
         type: z.ZodLiteral<"offer">;
     }, "strict", z.ZodTypeAny, {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     }, {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     }>;
-    mac: z.ZodString;
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
     senderRole: z.ZodEnum<["source", "destination"]>;
     sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "offer";
-    roomId: string;
     payload: {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
     mac: string;
 }, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "offer";
-    roomId: string;
     payload: {
         type: "offer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
     mac: string;
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"answer">;
     payload: z.ZodObject<{
         sdp: z.ZodString;
-        endpointNonce: z.ZodString;
     } & {
         type: z.ZodLiteral<"answer">;
     }, "strict", z.ZodTypeAny, {
         type: "answer";
         sdp: string;
-        endpointNonce: string;
     }, {
         type: "answer";
         sdp: string;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "answer";
+    payload: {
+        type: "answer";
+        sdp: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}, {
+    sequence: number;
+    version: 3;
+    kind: "answer";
+    payload: {
+        type: "answer";
+        sdp: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"candidate">;
+    payload: z.ZodObject<{
+        candidate: z.ZodString;
+        sdpMid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        sdpMLineIndex: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        usernameFragment: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "strict", z.ZodTypeAny, {
+        candidate: string;
+        sdpMid?: string | null | undefined;
+        sdpMLineIndex?: number | null | undefined;
+        usernameFragment?: string | null | undefined;
+    }, {
+        candidate: string;
+        sdpMid?: string | null | undefined;
+        sdpMLineIndex?: number | null | undefined;
+        usernameFragment?: string | null | undefined;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "candidate";
+    payload: {
+        candidate: string;
+        sdpMid?: string | null | undefined;
+        sdpMLineIndex?: number | null | undefined;
+        usernameFragment?: string | null | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}, {
+    sequence: number;
+    version: 3;
+    kind: "candidate";
+    payload: {
+        candidate: string;
+        sdpMid?: string | null | undefined;
+        sdpMLineIndex?: number | null | undefined;
+        usernameFragment?: string | null | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}>]>;
+/** HMAC-authenticated transport, offer, answer, or ICE signaling message. */
+export type AuthenticatedPairingSignal = z.infer<typeof authenticatedPairingSignalSchema>;
+/** Any signaling message relayed by peers-services: the PAKE share or an authenticated signal. */
+export declare const pairingSignalSchema: z.ZodUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"pake">;
+    payload: z.ZodObject<{
+        share: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        share: string;
+    }, {
+        share: string;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "pake";
+    payload: {
+        share: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}, {
+    sequence: number;
+    version: 3;
+    kind: "pake";
+    payload: {
+        share: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+}>, z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"transport-options">;
+    payload: z.ZodObject<{
+        endpointNonce: z.ZodString;
+        webrtc: z.ZodBoolean;
+        websocket: z.ZodOptional<z.ZodObject<{
+            urls: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            urls: string[];
+        }, {
+            urls: string[];
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    }, {
+        webrtc: boolean;
         endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
     }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+} & {
     mac: z.ZodString;
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "transport-options";
+    payload: {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}, {
+    sequence: number;
+    version: 3;
+    kind: "transport-options";
+    payload: {
+        webrtc: boolean;
+        endpointNonce: string;
+        websocket?: {
+            urls: string[];
+        } | undefined;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"transport-choice">;
+    payload: z.ZodDiscriminatedUnion<"selected", [z.ZodObject<{
+        endpointNonce: z.ZodString;
+        selected: z.ZodLiteral<"wrtc">;
+    }, "strict", z.ZodTypeAny, {
+        endpointNonce: string;
+        selected: "wrtc";
+    }, {
+        endpointNonce: string;
+        selected: "wrtc";
+    }>, z.ZodObject<{
+        endpointNonce: z.ZodString;
+        selected: z.ZodLiteral<"ws">;
+        url: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    }, {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    }>]>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
     senderRole: z.ZodEnum<["source", "destination"]>;
     sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     sequence: number;
-    version: 1;
+    version: 3;
+    kind: "transport-choice";
+    payload: {
+        endpointNonce: string;
+        selected: "wrtc";
+    } | {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}, {
+    sequence: number;
+    version: 3;
+    kind: "transport-choice";
+    payload: {
+        endpointNonce: string;
+        selected: "wrtc";
+    } | {
+        url: string;
+        endpointNonce: string;
+        selected: "ws";
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"offer">;
+    payload: z.ZodObject<{
+        sdp: z.ZodString;
+    } & {
+        type: z.ZodLiteral<"offer">;
+    }, "strict", z.ZodTypeAny, {
+        type: "offer";
+        sdp: string;
+    }, {
+        type: "offer";
+        sdp: string;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
+    kind: "offer";
+    payload: {
+        type: "offer";
+        sdp: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}, {
+    sequence: number;
+    version: 3;
+    kind: "offer";
+    payload: {
+        type: "offer";
+        sdp: string;
+    };
+    nameplate: number;
+    senderRole: "source" | "destination";
+    mac: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"answer">;
+    payload: z.ZodObject<{
+        sdp: z.ZodString;
+    } & {
+        type: z.ZodLiteral<"answer">;
+    }, "strict", z.ZodTypeAny, {
+        type: "answer";
+        sdp: string;
+    }, {
+        type: "answer";
+        sdp: string;
+    }>;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
+    senderRole: z.ZodEnum<["source", "destination"]>;
+    sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    sequence: number;
+    version: 3;
     kind: "answer";
-    roomId: string;
     payload: {
         type: "answer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
     mac: string;
 }, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "answer";
-    roomId: string;
     payload: {
         type: "answer";
         sdp: string;
-        endpointNonce: string;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
     mac: string;
 }>, z.ZodObject<{
@@ -333,90 +927,79 @@ export declare const pairingSignalSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
         sdpMLineIndex?: number | null | undefined;
         usernameFragment?: string | null | undefined;
     }>;
-    mac: z.ZodString;
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
     senderRole: z.ZodEnum<["source", "destination"]>;
     sequence: z.ZodNumber;
+} & {
+    mac: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "candidate";
-    roomId: string;
     payload: {
         candidate: string;
         sdpMid?: string | null | undefined;
         sdpMLineIndex?: number | null | undefined;
         usernameFragment?: string | null | undefined;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
     mac: string;
 }, {
     sequence: number;
-    version: 1;
+    version: 3;
     kind: "candidate";
-    roomId: string;
     payload: {
         candidate: string;
         sdpMid?: string | null | undefined;
         sdpMLineIndex?: number | null | undefined;
         usernameFragment?: string | null | undefined;
     };
+    nameplate: number;
     senderRole: "source" | "destination";
     mac: string;
-}>]>;
-/** Authenticated signaling message relayed by peers-services. */
+}>]>]>;
+/** Any signaling message relayed by peers-services. */
 export type PairingSignal = z.infer<typeof pairingSignalSchema>;
-/** Request from the source to create a bounded signaling room. */
+/** Request from the destination to create a bounded signaling room and receive a nameplate. */
 export declare const devicePairingCreateRoomRequestSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+    version: z.ZodLiteral<3>;
     expiresAt: z.ZodNumber;
-    roomAccessTokenHash: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
+    version: 3;
     expiresAt: number;
-    roomId: string;
-    roomAccessTokenHash: string;
 }, {
-    version: 1;
+    version: 3;
     expiresAt: number;
-    roomId: string;
-    roomAccessTokenHash: string;
 }>;
-/** Source request to create a bounded signaling room. */
+/** Destination request to create a bounded signaling room. */
 export type DevicePairingCreateRoomRequest = z.infer<typeof devicePairingCreateRoomRequestSchema>;
-/** Request from the destination to occupy the second room slot. */
+/** Request from the source to occupy the room named by the typed or scanned nameplate. */
 export declare const devicePairingJoinRoomRequestSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
-    roomAccessToken: z.ZodString;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
-    roomId: string;
-    roomAccessToken: string;
+    version: 3;
+    nameplate: number;
 }, {
-    version: 1;
-    roomId: string;
-    roomAccessToken: string;
+    version: 3;
+    nameplate: number;
 }>;
-/** Destination request to join a bounded signaling room. */
+/** Source request to join a bounded signaling room. */
 export type DevicePairingJoinRoomRequest = z.infer<typeof devicePairingJoinRoomRequestSchema>;
-/** Request from the source to tear down its signaling room. */
+/** Request from the creating destination socket to tear down its signaling room. */
 export declare const devicePairingDeleteRoomRequestSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
-    roomAccessToken: z.ZodString;
+    version: z.ZodLiteral<3>;
+    nameplate: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
-    roomId: string;
-    roomAccessToken: string;
+    version: 3;
+    nameplate: number;
 }, {
-    version: 1;
-    roomId: string;
-    roomAccessToken: string;
+    version: 3;
+    nameplate: number;
 }>;
-/** Source request to delete a bounded signaling room. */
+/** Destination request to delete a bounded signaling room. */
 export type DevicePairingDeleteRoomRequest = z.infer<typeof devicePairingDeleteRoomRequestSchema>;
 /** Public signaling-service error codes that do not echo attacker input. */
 export declare const devicePairingSignalingErrorCodeSchema: z.ZodEnum<["invalid", "not-found", "occupied", "expired", "forbidden", "rate-limited", "too-large", "out-of-order"]>;
@@ -441,7 +1024,32 @@ export declare const devicePairingSignalingAckSchema: z.ZodDiscriminatedUnion<"o
 }>]>;
 /** Acknowledgement returned by every signaling-room command. */
 export type DevicePairingSignalingAck = z.infer<typeof devicePairingSignalingAckSchema>;
-/** Acknowledgement proving room creation/join and its service-authoritative expiry. */
+/** Acknowledgement returned to the destination with its allocated nameplate and expiry. */
+export declare const devicePairingRoomCreatedAckSchema: z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    nameplate: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    ok: true;
+    expiresAt: number;
+    nameplate: number;
+}, {
+    ok: true;
+    expiresAt: number;
+    nameplate: number;
+}>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    code: z.ZodEnum<["invalid", "not-found", "occupied", "expired", "forbidden", "rate-limited", "too-large", "out-of-order"]>;
+}, "strict", z.ZodTypeAny, {
+    code: "invalid" | "expired" | "not-found" | "occupied" | "forbidden" | "rate-limited" | "too-large" | "out-of-order";
+    ok: false;
+}, {
+    code: "invalid" | "expired" | "not-found" | "occupied" | "forbidden" | "rate-limited" | "too-large" | "out-of-order";
+    ok: false;
+}>]>;
+/** Room-created acknowledgement returned by create. */
+export type DevicePairingRoomCreatedAck = z.infer<typeof devicePairingRoomCreatedAckSchema>;
+/** Acknowledgement proving a room join and its service-authoritative expiry. */
 export declare const devicePairingRoomReadyAckSchema: z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
     ok: z.ZodLiteral<true>;
     expiresAt: z.ZodNumber;
@@ -461,7 +1069,7 @@ export declare const devicePairingRoomReadyAckSchema: z.ZodDiscriminatedUnion<"o
     code: "invalid" | "expired" | "not-found" | "occupied" | "forbidden" | "rate-limited" | "too-large" | "out-of-order";
     ok: false;
 }>]>;
-/** Room-ready acknowledgement returned by create and join. */
+/** Room-ready acknowledgement returned by join. */
 export type DevicePairingRoomReadyAck = z.infer<typeof devicePairingRoomReadyAckSchema>;
 /** Acknowledgement containing room-bound, short-lived ICE configuration. */
 export declare const devicePairingIceServersAckSchema: z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
@@ -513,10 +1121,17 @@ export declare const devicePairingIceServersAckSchema: z.ZodDiscriminatedUnion<"
 }>]>;
 /** ICE configuration acknowledgement returned only to a room member. */
 export type DevicePairingIceServersAck = z.infer<typeof devicePairingIceServersAckSchema>;
-/** Canonical transcript input derived independently by both endpoints. */
+/**
+ * Canonical transcript input derived independently by both endpoints.
+ *
+ * `transportBinding` pins the negotiated data channel: for `wrtc` it is the sorted SHA-256 DTLS
+ * fingerprints of the offer and answer (`offer|answer`); for `ws` it is the destination URL the
+ * source connected to, exactly as advertised in the MACed transport options.
+ */
 export declare const devicePairingTranscriptSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    roomId: z.ZodString;
+    version: z.ZodLiteral<3>;
+    serviceOrigin: z.ZodEffects<z.ZodString, string, string>;
+    nameplate: z.ZodNumber;
     sourceIdentity: z.ZodObject<{
         userId: z.ZodEffects<z.ZodString, string, string>;
         deviceId: z.ZodEffects<z.ZodString, string, string>;
@@ -563,11 +1178,13 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     }>;
     sourceEndpointNonce: z.ZodString;
     destinationEndpointNonce: z.ZodString;
-    offerFingerprint: z.ZodString;
-    answerFingerprint: z.ZodString;
+    transport: z.ZodEnum<["wrtc", "ws"]>;
+    transportBinding: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
-    roomId: string;
+    transport: "ws" | "wrtc";
+    version: 3;
+    serviceOrigin: string;
+    nameplate: number;
     sourceIdentity: {
         publicKey: string;
         publicBoxKey: string;
@@ -586,11 +1203,12 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     };
     sourceEndpointNonce: string;
     destinationEndpointNonce: string;
-    offerFingerprint: string;
-    answerFingerprint: string;
+    transportBinding: string;
 }, {
-    version: 1;
-    roomId: string;
+    transport: "ws" | "wrtc";
+    version: 3;
+    serviceOrigin: string;
+    nameplate: number;
     sourceIdentity: {
         publicKey: string;
         publicBoxKey: string;
@@ -609,8 +1227,7 @@ export declare const devicePairingTranscriptSchema: z.ZodObject<{
     };
     sourceEndpointNonce: string;
     destinationEndpointNonce: string;
-    offerFingerprint: string;
-    answerFingerprint: string;
+    transportBinding: string;
 }>;
 /** Inputs whose canonical hash identifies one pairing connection. */
 export type DevicePairingTranscript = z.infer<typeof devicePairingTranscriptSchema>;
@@ -630,9 +1247,10 @@ export declare const pairingDevicePresentationSchema: z.ZodObject<{
 }>;
 /** Renderer-safe presentation of the remote endpoint. */
 export type PairingDevicePresentation = z.infer<typeof pairingDevicePresentationSchema>;
-/** Payload exchanged by `pairing.describe` after the normal Connection handshake. */
-export declare const pairingDescriptionSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
+/** Unauthenticated contents of a `pairing.confirm` message. */
+export declare const pairingConfirmationContentsSchema: z.ZodObject<{
+    version: z.ZodLiteral<3>;
+    role: z.ZodEnum<["source", "destination"]>;
     transcriptHash: z.ZodString;
     device: z.ZodObject<{
         userId: z.ZodEffects<z.ZodString, string, string>;
@@ -670,7 +1288,8 @@ export declare const pairingDescriptionSchema: z.ZodObject<{
         deviceType?: string | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
+    role: "source" | "destination";
+    version: 3;
     device: {
         publicKey: string;
         publicBoxKey: string;
@@ -686,7 +1305,8 @@ export declare const pairingDescriptionSchema: z.ZodObject<{
         deviceType?: string | undefined;
     };
 }, {
-    version: 1;
+    role: "source" | "destination";
+    version: 3;
     device: {
         publicKey: string;
         publicBoxKey: string;
@@ -702,91 +1322,107 @@ export declare const pairingDescriptionSchema: z.ZodObject<{
         deviceType?: string | undefined;
     };
 }>;
-/** Payload exchanged by `pairing.describe`. */
-export type PairingDescription = z.infer<typeof pairingDescriptionSchema>;
-/** Contents of a signed, single-use user approval. */
-export declare const pairingApprovalContentsSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    approvalId: z.ZodString;
-    transcriptHash: z.ZodString;
+/** Unauthenticated contents of a `pairing.confirm` message. */
+export type PairingConfirmationContents = z.infer<typeof pairingConfirmationContentsSchema>;
+/**
+ * Payload exchanged by `pairing.confirm` after the Connection handshake. The MAC uses the
+ * PAKE-derived confirmation key, proving the peer knew the code and saw the same transcript.
+ */
+export declare const pairingConfirmationSchema: z.ZodObject<{
+    version: z.ZodLiteral<3>;
     role: z.ZodEnum<["source", "destination"]>;
-    expiresAt: z.ZodNumber;
-}, "strict", z.ZodTypeAny, {
-    role: "source" | "destination";
-    version: 1;
-    expiresAt: number;
-    approvalId: string;
-    transcriptHash: string;
-}, {
-    role: "source" | "destination";
-    version: 1;
-    expiresAt: number;
-    approvalId: string;
-    transcriptHash: string;
-}>;
-/** Contents of a signed pairing approval. */
-export type PairingApprovalContents = z.infer<typeof pairingApprovalContentsSchema>;
-/** Signed approval bound to one transcript and endpoint identity. */
-export declare const signedPairingApprovalSchema: z.ZodObject<{
-    contents: z.ZodObject<{
-        version: z.ZodLiteral<1>;
-        approvalId: z.ZodString;
-        transcriptHash: z.ZodString;
-        role: z.ZodEnum<["source", "destination"]>;
-        expiresAt: z.ZodNumber;
+    transcriptHash: z.ZodString;
+    device: z.ZodObject<{
+        userId: z.ZodEffects<z.ZodString, string, string>;
+        deviceId: z.ZodEffects<z.ZodString, string, string>;
+        publicKey: z.ZodString;
+        publicBoxKey: z.ZodString;
+        userName: z.ZodOptional<z.ZodString>;
+        deviceName: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        deviceId: string;
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+    }, {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        deviceId: string;
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+    }>;
+    presentation: z.ZodObject<{
+        deviceName: z.ZodOptional<z.ZodString>;
+        userName: z.ZodOptional<z.ZodString>;
+        deviceType: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
-        role: "source" | "destination";
-        version: 1;
-        expiresAt: number;
-        approvalId: string;
-        transcriptHash: string;
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+        deviceType?: string | undefined;
     }, {
-        role: "source" | "destination";
-        version: 1;
-        expiresAt: number;
-        approvalId: string;
-        transcriptHash: string;
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+        deviceType?: string | undefined;
     }>;
-    signature: z.ZodString;
-    publicKey: z.ZodString;
+} & {
+    mac: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    publicKey: string;
-    signature: string;
-    contents: {
-        role: "source" | "destination";
-        version: 1;
-        expiresAt: number;
-        approvalId: string;
-        transcriptHash: string;
+    role: "source" | "destination";
+    version: 3;
+    device: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        deviceId: string;
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+    };
+    mac: string;
+    transcriptHash: string;
+    presentation: {
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+        deviceType?: string | undefined;
     };
 }, {
-    publicKey: string;
-    signature: string;
-    contents: {
-        role: "source" | "destination";
-        version: 1;
-        expiresAt: number;
-        approvalId: string;
-        transcriptHash: string;
+    role: "source" | "destination";
+    version: 3;
+    device: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        deviceId: string;
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+    };
+    mac: string;
+    transcriptHash: string;
+    presentation: {
+        deviceName?: string | undefined;
+        userName?: string | undefined;
+        deviceType?: string | undefined;
     };
 }>;
-/** Signed approval bound to one transcript and endpoint identity. */
-export type SignedPairingApproval = z.infer<typeof signedPairingApprovalSchema>;
+/** Payload exchanged by `pairing.confirm`. */
+export type PairingConfirmation = z.infer<typeof pairingConfirmationSchema>;
 /** Account credentials encrypted directly to the temporary destination identity. */
 export declare const pairingCredentialContentsSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
+    version: z.ZodLiteral<3>;
     transcriptHash: z.ZodString;
     expiresAt: z.ZodNumber;
     userId: z.ZodEffects<z.ZodString, string, string>;
     secretKey: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
+    version: 3;
     secretKey: string;
     userId: string;
     expiresAt: number;
     transcriptHash: string;
 }, {
-    version: 1;
+    version: 3;
     secretKey: string;
     userId: string;
     expiresAt: number;
@@ -794,7 +1430,7 @@ export declare const pairingCredentialContentsSchema: z.ZodObject<{
 }>;
 /** Account credentials before they are signed and boxed. */
 export type PairingCredentialContents = z.infer<typeof pairingCredentialContentsSchema>;
-/** Signed-and-boxed credential envelope sent over the WebRTC Connection. */
+/** Signed-and-boxed credential envelope sent over the pairing Connection. */
 export declare const pairingCredentialEnvelopeSchema: z.ZodObject<{
     contents: z.ZodString;
     nonce: z.ZodString;
@@ -808,11 +1444,11 @@ export declare const pairingCredentialEnvelopeSchema: z.ZodObject<{
     contents: string;
     fromPublicKey: string;
 }>;
-/** Signed-and-boxed credential envelope sent over the WebRTC Connection. */
+/** Signed-and-boxed credential envelope sent over the pairing Connection. */
 export type PairingCredentialEnvelope = z.infer<typeof pairingCredentialEnvelopeSchema>;
 /** Contents of the temporary destination identity's signed installation receipt. */
 export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
-    version: z.ZodLiteral<1>;
+    version: z.ZodLiteral<3>;
     transcriptHash: z.ZodString;
     initializedDevice: z.ZodObject<{
         userId: z.ZodEffects<z.ZodString, string, string>;
@@ -838,7 +1474,7 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     }>;
     installedAt: z.ZodNumber;
 }, "strict", z.ZodTypeAny, {
-    version: 1;
+    version: 3;
     transcriptHash: string;
     initializedDevice: {
         publicKey: string;
@@ -850,7 +1486,7 @@ export declare const pairingInstallationReceiptContentsSchema: z.ZodObject<{
     };
     installedAt: number;
 }, {
-    version: 1;
+    version: 3;
     transcriptHash: string;
     initializedDevice: {
         publicKey: string;
@@ -867,7 +1503,7 @@ export type PairingInstallationReceiptContents = z.infer<typeof pairingInstallat
 /** Receipt proving installation on the authenticated temporary destination endpoint. */
 export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
     contents: z.ZodObject<{
-        version: z.ZodLiteral<1>;
+        version: z.ZodLiteral<3>;
         transcriptHash: z.ZodString;
         initializedDevice: z.ZodObject<{
             userId: z.ZodEffects<z.ZodString, string, string>;
@@ -893,7 +1529,7 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         }>;
         installedAt: z.ZodNumber;
     }, "strict", z.ZodTypeAny, {
-        version: 1;
+        version: 3;
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
@@ -905,7 +1541,7 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
         };
         installedAt: number;
     }, {
-        version: 1;
+        version: 3;
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
@@ -923,7 +1559,7 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
     publicKey: string;
     signature: string;
     contents: {
-        version: 1;
+        version: 3;
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
@@ -939,7 +1575,7 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
     publicKey: string;
     signature: string;
     contents: {
-        version: 1;
+        version: 3;
         transcriptHash: string;
         initializedDevice: {
             publicKey: string;
@@ -954,15 +1590,22 @@ export declare const signedPairingInstallationReceiptSchema: z.ZodObject<{
 }>;
 /** Receipt proving installation on the authenticated temporary destination endpoint. */
 export type SignedPairingInstallationReceipt = z.infer<typeof signedPairingInstallationReceiptSchema>;
-/** Renderer-visible phases of the short-lived pairing ceremony. */
-export declare const devicePairingPhaseSchema: z.ZodEnum<["idle", "inviting", "connecting", "comparing", "waiting-for-approval", "transferring", "complete", "rejected", "error"]>;
+/**
+ * Renderer-visible phases of the short-lived pairing ceremony.
+ *
+ * - `showing-code`: destination is displaying its code and waiting for a source to join.
+ * - `connecting`: room joined; transport negotiation and the Connection handshake are in progress.
+ * - `authenticating`: PAKE-derived confirmations are being exchanged.
+ * - `waiting-for-approval`: source must tap Approve; destination waits for it.
+ */
+export declare const devicePairingPhaseSchema: z.ZodEnum<["idle", "showing-code", "connecting", "authenticating", "waiting-for-approval", "transferring", "complete", "rejected", "error"]>;
 /** Renderer-visible phase of the short-lived pairing ceremony. */
 export type DevicePairingPhase = z.infer<typeof devicePairingPhaseSchema>;
 /** Sanitized pairing state safe to publish across the host/renderer boundary. */
 export declare const devicePairingStateSchema: z.ZodObject<{
     sessionId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     role: z.ZodOptional<z.ZodEnum<["source", "destination"]>>;
-    phase: z.ZodEnum<["idle", "inviting", "connecting", "comparing", "waiting-for-approval", "transferring", "complete", "rejected", "error"]>;
+    phase: z.ZodEnum<["idle", "showing-code", "connecting", "authenticating", "waiting-for-approval", "transferring", "complete", "rejected", "error"]>;
     expiresAt: z.ZodOptional<z.ZodNumber>;
     remoteDevice: z.ZodOptional<z.ZodObject<{
         deviceName: z.ZodOptional<z.ZodString>;
@@ -977,10 +1620,14 @@ export declare const devicePairingStateSchema: z.ZodObject<{
         userName?: string | undefined;
         deviceType?: string | undefined;
     }>>;
-    sas: z.ZodOptional<z.ZodString>;
+    /** Destination only: the code to show as text and QR while `showing-code`. */
+    code: z.ZodOptional<z.ZodString>;
+    /** Non-fatal message shown alongside the current phase (e.g. why a code was rotated). */
+    notice: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
-    phase: "error" | "connecting" | "idle" | "complete" | "rejected" | "inviting" | "comparing" | "waiting-for-approval" | "transferring";
+    phase: "error" | "connecting" | "idle" | "complete" | "rejected" | "showing-code" | "authenticating" | "waiting-for-approval" | "transferring";
+    code?: string | undefined;
     error?: string | undefined;
     role?: "source" | "destination" | undefined;
     sessionId?: string | undefined;
@@ -990,9 +1637,10 @@ export declare const devicePairingStateSchema: z.ZodObject<{
         userName?: string | undefined;
         deviceType?: string | undefined;
     } | undefined;
-    sas?: string | undefined;
+    notice?: string | undefined;
 }, {
-    phase: "error" | "connecting" | "idle" | "complete" | "rejected" | "inviting" | "comparing" | "waiting-for-approval" | "transferring";
+    phase: "error" | "connecting" | "idle" | "complete" | "rejected" | "showing-code" | "authenticating" | "waiting-for-approval" | "transferring";
+    code?: string | undefined;
     error?: string | undefined;
     role?: "source" | "destination" | undefined;
     sessionId?: string | undefined;
@@ -1002,18 +1650,16 @@ export declare const devicePairingStateSchema: z.ZodObject<{
         userName?: string | undefined;
         deviceType?: string | undefined;
     } | undefined;
-    sas?: string | undefined;
+    notice?: string | undefined;
 }>;
 /** Sanitized pairing state safe to publish across the host/renderer boundary. */
 export type DevicePairingState = z.infer<typeof devicePairingStateSchema>;
-/** One-time source start result; emitted state never contains the invitation URL. */
-export interface DevicePairingStartSourceResult {
-    state: DevicePairingState;
-    invitationUrl: string;
+/** Input for starting a source-side ceremony from a typed or scanned pairing code. */
+export interface DevicePairingStartSourceInput {
+    code: string;
 }
-/** Input for starting a destination-side pairing ceremony. */
+/** Input for starting a destination-side ceremony that displays a code. */
 export interface DevicePairingStartDestinationInput {
-    invitation: string;
     deviceName?: string;
     deviceType?: string;
 }