ryco-cli 0.1.20 → 0.1.21

package/dist/{collectUint8StreamText-CDu-bszH.cjs → collectUint8StreamText-C5fop6Zf.cjs}

@@ -365,6 +365,7 @@ const AdvertisedEndpoint = effect.Schema.Struct({
 	isDefault: effect.Schema.optional(effect.Schema.Boolean),
 	description: effect.Schema.optional(TrimmedNonEmptyString)
 });
+const RELAY_E2EE_CAPABILITY_STATEMENT_MAX_BYTES = 5190;
 const RELAY_MAX_CONTROL_FRAME_BYTES = 262144;
 const RELAY_MAX_DATA_CHUNK_BYTES = 262144;
 const RELAY_MAX_DATA_FRAME_OVERHEAD_BYTES = 1024;
@@ -427,7 +428,11 @@ const RELAY_FRAME_TYPES = [
 	"channel.close",
 	"ping",
 	"pong",
-	"error"
+	"error",
+	"node.e2ee.statement",
+	"node.e2ee.statement.ack",
+	"e2ee.verifier-keys",
+	"e2ee.enrollment-revoked"
 ];
 const RELAY_PROTOCOL_ERROR_CODES = [
 	"invalid_encoding",
@@ -438,7 +443,7 @@ const RELAY_PROTOCOL_ERROR_CODES = [
 	...RELAY_CLOSE_REASONS
 ];
 const UInt16 = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(65535));
-const UInt32 = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(4294967295));
+const UInt32$1 = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(4294967295));
 const RetryAfterMs = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(RELAY_MAX_RETRY_AFTER_MS));
 const ProtocolFields = {
 	protocolMajor: UInt16,
@@ -457,11 +462,25 @@ const RelayEffectiveRole = effect.Schema.Literals([
 const RelayProtocolErrorCode = effect.Schema.Literals(RELAY_PROTOCOL_ERROR_CODES);
 const RelayNodeId = effect.Schema.String.check(effect.Schema.isPattern(/^node_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(48)).pipe(effect.Schema.brand("RelayNodeId"));
 const RelayChannelId = effect.Schema.String.check(effect.Schema.isPattern(/^ch_[A-Za-z0-9_-]{22}$/), effect.Schema.isMaxLength(25)).pipe(effect.Schema.brand("RelayChannelId"));
-const RelaySequence = UInt32.pipe(effect.Schema.brand("RelaySequence"));
+const NativeE2eeEnrollmentId = effect.Schema.String.check(effect.Schema.isPattern(/^enr_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(47)).pipe(effect.Schema.brand("NativeE2eeEnrollmentId"));
+const HubGrantVerificationKeyId = effect.Schema.String.check(effect.Schema.isPattern(/^hgk_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(47)).pipe(effect.Schema.brand("HubGrantVerificationKeyId"));
+const RelayTicketId = effect.Schema.String.check(effect.Schema.isPattern(/^rtk_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(47)).pipe(effect.Schema.brand("RelayTicketId"));
+const NativeE2eeEnrollmentRevision = UInt32$1.check(effect.Schema.isGreaterThanOrEqualTo(1)).pipe(effect.Schema.brand("NativeE2eeEnrollmentRevision"));
+const E2eeAuthorizationEpoch = UInt32$1.pipe(effect.Schema.brand("E2eeAuthorizationEpoch"));
+const E2eeKeysetGeneration = UInt32$1.pipe(effect.Schema.brand("E2eeKeysetGeneration"));
+const RelayConnectorGeneration = UInt32$1.pipe(effect.Schema.brand("RelayConnectorGeneration"));
+const RelaySequence = UInt32$1.pipe(effect.Schema.brand("RelaySequence"));
 const RelayHeartbeatNonce = boundedBytes(8, 8);
 const RelayAuthenticationNonce = boundedBytes(32, 32);
 const RelaySignatureMaterial = boundedBytes(64, 512);
 const RelayTicketMaterial = boundedBytes(32, 64);
+const RelayE2eeDigest = boundedBytes(32, 32).pipe(effect.Schema.brand("RelayE2eeDigest"));
+const RelayAccountGrantContext = effect.Schema.Tuple([
+	effect.Schema.Literal(2),
+	RelayTicketId,
+	RelayE2eeDigest,
+	RelayE2eeDigest
+]);
 const RelayLimits = effect.Schema.Struct({
 	maxControlFrameBytes: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(RELAY_MIN_CONTROL_FRAME_BYTES), effect.Schema.isLessThanOrEqualTo(RELAY_MAX_CONTROL_FRAME_BYTES)),
 	maxDataChunkBytes: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(RELAY_MIN_DATA_CHUNK_BYTES), effect.Schema.isLessThanOrEqualTo(RELAY_MAX_DATA_CHUNK_BYTES)),
@@ -490,7 +509,11 @@ const minorVersionSupportsCloseReason = (protocolMinor, reason) => reason === vo
 const minorVersionSupportsAuthorizedChannel = (input) => {
 	const hasCapability = input.capability !== void 0;
 	const hasEffectiveRole = input.effectiveRole !== void 0;
-	if (input.protocolMinor >= 2) return hasCapability && hasEffectiveRole ? void 0 : "protocol minor version 2 or newer requires channel authorization metadata";
+	if (input.accountGrantContext !== void 0 && input.protocolMinor < 3) return "account grant context requires protocol minor version 3 or newer";
+	if (input.protocolMinor >= 2) {
+		if (!hasCapability || !hasEffectiveRole) return "protocol minor version 2 or newer requires channel authorization metadata";
+		return;
+	}
 	return !hasCapability && !hasEffectiveRole ? void 0 : "channel authorization metadata requires protocol minor version 2 or newer";
 };
 const RelayNodeAuthHandshake = effect.Schema.Struct({
@@ -518,8 +541,43 @@ const RelayChannelOpenFrame = effect.Schema.Struct({
 	...ProtocolFields,
 	channelId: RelayChannelId,
 	capability: effect.Schema.optionalKey(RelayCapability),
-	effectiveRole: effect.Schema.optionalKey(RelayEffectiveRole)
+	effectiveRole: effect.Schema.optionalKey(RelayEffectiveRole),
+	accountGrantContext: effect.Schema.optionalKey(RelayAccountGrantContext)
 }).check(effect.Schema.makeFilter(minorVersionSupportsAuthorizedChannel));
+const minor3Frame = (fields) => effect.Schema.Struct({
+	...fields,
+	...ProtocolFields
+}).check(effect.Schema.makeFilter((frame) => frame.protocolMinor >= 3 ? void 0 : "frame requires protocol minor version 3 or newer"));
+const RelayNodeE2eeStatementFrame = minor3Frame({
+	type: effect.Schema.Literal("node.e2ee.statement"),
+	connectorGeneration: RelayConnectorGeneration,
+	statement: boundedBytes(1, RELAY_E2EE_CAPABILITY_STATEMENT_MAX_BYTES),
+	statementDigest: RelayE2eeDigest,
+	expiresAt: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER))
+});
+const RelayNodeE2eeStatementAckFrame = minor3Frame({
+	type: effect.Schema.Literal("node.e2ee.statement.ack"),
+	connectorGeneration: RelayConnectorGeneration,
+	statementDigest: RelayE2eeDigest
+});
+const RelayHubGrantVerificationKey = effect.Schema.Struct({
+	keyId: HubGrantVerificationKeyId,
+	publicKey: boundedBytes(32, 32),
+	notBefore: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)),
+	notAfter: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER))
+}).check(effect.Schema.makeFilter((key) => key.notAfter > key.notBefore ? void 0 : "notAfter must be after notBefore"));
+const RelayE2eeVerifierKeysFrame = minor3Frame({
+	type: effect.Schema.Literal("e2ee.verifier-keys"),
+	generation: E2eeKeysetGeneration,
+	keys: effect.Schema.Array(RelayHubGrantVerificationKey).check(effect.Schema.isMinLength(1), effect.Schema.isMaxLength(4), effect.Schema.makeFilter((keys) => new Set(keys.map((key) => key.keyId)).size === keys.length ? void 0 : "grant verification key ids must be distinct"))
+});
+const RelayE2eeEnrollmentRevokedFrame = minor3Frame({
+	type: effect.Schema.Literal("e2ee.enrollment-revoked"),
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	deviceAuthEpoch: E2eeAuthorizationEpoch
+});
 const RelayChannelAcceptFrame = effect.Schema.Struct({
 	type: effect.Schema.Literal("channel.accept"),
 	...ProtocolFields,
@@ -573,7 +631,7 @@ const RelaySupportedVersionRange = effect.Schema.Struct({
 const RELAY_SUPPORTED_VERSION_RANGE = RelaySupportedVersionRange.make({
 	protocolMajor: 1,
 	minimumMinor: 0,
-	maximumMinor: 2
+	maximumMinor: 3
 });
 const RelayErrorFrame = effect.Schema.Struct({
 	type: effect.Schema.Literal("error"),
@@ -604,7 +662,11 @@ const RelayControlFrame = effect.Schema.Union([
 	RelayChannelCloseFrame,
 	RelayPingFrame,
 	RelayPongFrame,
-	RelayErrorFrame
+	RelayErrorFrame,
+	RelayNodeE2eeStatementFrame,
+	RelayNodeE2eeStatementAckFrame,
+	RelayE2eeVerifierKeysFrame,
+	RelayE2eeEnrollmentRevokedFrame
 ]);
 const RelayFrame = effect.Schema.Union([RelayControlFrame, RelayDataFrame]);
 //#endregion
@@ -660,7 +722,7 @@ const HubConnectorStatus = effect.Schema.Struct({
 	if (status.state === "degraded" && status.degradedMode === void 0) return "degraded status requires degradedMode";
 	if (status.state !== "degraded" && status.degradedMode !== void 0) return "degradedMode is allowed only for degraded status";
 	if (status.state === "online") {
-		if (status.protocolMajor !== 1 || status.protocolMinor !== 2) return "online status requires the supported relay protocol";
+		if (status.protocolMajor !== 1 || status.protocolMinor === void 0 || status.protocolMinor < 2 || status.protocolMinor > 3) return "online status requires the supported relay protocol";
 	} else if (status.protocolMajor !== void 0 || status.protocolMinor !== void 0) return "protocol is exposed only while online";
 	if (status.nextRetryAt !== void 0 && status.degradedMode !== "backing_off") return "nextRetryAt requires backing_off";
 	if (status.state !== "online" && status.activeChannels !== 0) return "active channels require online status";
@@ -731,16 +793,16 @@ const HubEnrollmentStartResult = effect.Schema.Struct({
 	...HubEnrollmentCeremonyDetail.fields
 });
 const HOSTED_IDENTITY_MAX_ANTI_BOT_ASSERTION_CHARS = 8192;
-const strict$3 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
-const EpochMs$1 = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0));
+const strict$4 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
+const EpochMs$2 = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0));
 const Opaque256 = effect.Schema.String.check(effect.Schema.isMinLength(43), effect.Schema.isMaxLength(43), effect.Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
-const AccountId$1 = effect.Schema.String.check(effect.Schema.isPattern(/^acct_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(48));
+const HubAccountId = effect.Schema.String.check(effect.Schema.isPattern(/^acct_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(48));
 const SessionId$1 = effect.Schema.String.check(effect.Schema.isPattern(/^sess_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(48));
 const BoundedDisplayName = effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(200));
 const BoundedSpaceDisplayName = effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(100));
 const BoundedPassword = effect.Schema.String.check(effect.Schema.isMinLength(12), effect.Schema.isMaxLength(256));
 const AntiBotAssertion = effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(HOSTED_IDENTITY_MAX_ANTI_BOT_ASSERTION_CHARS));
-const IdempotencyKey = Opaque256.pipe(effect.Schema.brand("HostedIdentityIdempotencyKey"));
+const IdempotencyKey$1 = Opaque256.pipe(effect.Schema.brand("HostedIdentityIdempotencyKey"));
 const SignupAttemptSecret = Opaque256.pipe(effect.Schema.brand("PublicSignupAttemptSecret"));
 const SignupActivationSecret = Opaque256.pipe(effect.Schema.brand("PublicSignupActivationSecret"));
 const PasswordLoginAttemptSecret = Opaque256.pipe(effect.Schema.brand("PasswordLoginAttemptSecret"));
@@ -753,10 +815,10 @@ const MailToken = Opaque256.pipe(effect.Schema.brand("HostedIdentityMailToken"))
 const EmailCode = effect.Schema.String.check(effect.Schema.isPattern(/^[0-9]{6}$/));
 const TotpCode = effect.Schema.String.check(effect.Schema.isPattern(/^[0-9]{6}$/));
 const JsonObject = effect.Schema.Unknown.check(effect.Schema.makeFilter((value) => typeof value === "object" && value !== null && !Array.isArray(value) ? void 0 : "value must be an object"));
-const strictTimed = (fields) => strict$3(effect.Schema.Struct({
+const strictTimed = (fields) => strict$4(effect.Schema.Struct({
 	...fields,
-	issuedAt: EpochMs$1,
-	expiresAt: EpochMs$1
+	issuedAt: EpochMs$2,
+	expiresAt: EpochMs$2
 }).check(effect.Schema.makeFilter((value) => {
 	const timed = value;
 	return timed.expiresAt > timed.issuedAt ? void 0 : "expiresAt must be after issuedAt";
@@ -774,14 +836,14 @@ const HubNormalizedEmail = effect.Schema.String.check(effect.Schema.isMinLength(
 const HubLoginIdentifier = effect.Schema.Union([HubUsername, HubNormalizedEmail]).pipe(effect.Schema.brand("HubLoginIdentifier"));
 const PublicSignupTurnstileSiteKey = effect.Schema.String.check(effect.Schema.isMinLength(10), effect.Schema.isMaxLength(128), effect.Schema.isPattern(/^[A-Za-z0-9_-]+$/));
 effect.Schema.Union([
-	strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("disabled") })),
-	strict$3(effect.Schema.Struct({
+	strict$4(effect.Schema.Struct({ status: effect.Schema.Literal("disabled") })),
+	strict$4(effect.Schema.Struct({
 		status: effect.Schema.Literal("enabled"),
-		antiBot: strict$3(effect.Schema.Struct({ provider: effect.Schema.Literal("bypass") }))
+		antiBot: strict$4(effect.Schema.Struct({ provider: effect.Schema.Literal("bypass") }))
 	})),
-	strict$3(effect.Schema.Struct({
+	strict$4(effect.Schema.Struct({
 		status: effect.Schema.Literal("enabled"),
-		antiBot: strict$3(effect.Schema.Struct({
+		antiBot: strict$4(effect.Schema.Struct({
 			provider: effect.Schema.Literal("turnstile"),
 			siteKey: PublicSignupTurnstileSiteKey
 		}))
@@ -789,21 +851,21 @@ effect.Schema.Union([
 ]);
 const ExternalIdentityProvider = effect.Schema.Literal("github");
 const ExternalIdentityLogin = effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(100), effect.Schema.isPattern(/^[A-Za-z0-9-]+$/));
-const ExternalIdentitySummary = strict$3(effect.Schema.Struct({
+const ExternalIdentitySummary = strict$4(effect.Schema.Struct({
 	provider: ExternalIdentityProvider,
 	login: ExternalIdentityLogin,
 	displayName: effect.Schema.NullOr(BoundedDisplayName),
-	connectedAt: EpochMs$1,
-	lastUsedAt: effect.Schema.NullOr(EpochMs$1)
+	connectedAt: EpochMs$2,
+	lastUsedAt: effect.Schema.NullOr(EpochMs$2)
 }).check(effect.Schema.makeFilter((value) => value.lastUsedAt === null || value.lastUsedAt >= value.connectedAt ? void 0 : "lastUsedAt must not precede connectedAt")));
-const ExternalIdentityProviderPolicy = strict$3(effect.Schema.Struct({
+const ExternalIdentityProviderPolicy = strict$4(effect.Schema.Struct({
 	provider: ExternalIdentityProvider,
 	login: effect.Schema.Literal(true),
 	signup: effect.Schema.Boolean,
 	link: effect.Schema.Literal(true)
 }));
 const ExternalIdentityProviders = effect.Schema.Array(ExternalIdentityProviderPolicy).check(effect.Schema.isMaxLength(1), effect.Schema.makeFilter((providers) => new Set(providers.map((provider) => provider.provider)).size === providers.length ? void 0 : "external identity providers must be unique"));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	version: effect.Schema.Literal(1),
 	providers: ExternalIdentityProviders
 }));
@@ -823,14 +885,14 @@ const GitHubAuthorizationUrl = effect.Schema.String.check(effect.Schema.isNonEmp
 		return "authorization URL must be absolute";
 	}
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	provider: ExternalIdentityProvider,
 	intent: effect.Schema.Literals(["authenticate", "link"]),
 	returnTo: effect.Schema.optionalKey(ExternalIdentityReturnPath)
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	authorizationUrl: GitHubAuthorizationUrl,
-	expiresAt: EpochMs$1
+	expiresAt: EpochMs$2
 }));
 const ExternalIdentityPendingErrorCode = effect.Schema.Literals([
 	"external_provider_unavailable",
@@ -843,72 +905,72 @@ const ExternalIdentityPendingErrorCode = effect.Schema.Literals([
 	"username_unavailable"
 ]);
 effect.Schema.Union([
-	strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("none") })),
-	strict$3(effect.Schema.Struct({
+	strict$4(effect.Schema.Struct({ status: effect.Schema.Literal("none") })),
+	strict$4(effect.Schema.Struct({
 		status: effect.Schema.Literal("signup"),
 		provider: ExternalIdentityProvider,
 		suggestedUsername: effect.Schema.NullOr(HubUsername),
 		displayName: effect.Schema.NullOr(BoundedDisplayName),
-		expiresAt: EpochMs$1
+		expiresAt: EpochMs$2
 	})),
-	strict$3(effect.Schema.Struct({
+	strict$4(effect.Schema.Struct({
 		status: effect.Schema.Literal("link"),
 		externalIdentity: ExternalIdentitySummary,
-		expiresAt: EpochMs$1
+		expiresAt: EpochMs$2
 	})),
-	strict$3(effect.Schema.Struct({
+	strict$4(effect.Schema.Struct({
 		status: effect.Schema.Literal("error"),
 		provider: ExternalIdentityProvider,
 		code: ExternalIdentityPendingErrorCode
 	}))
 ]);
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	provider: ExternalIdentityProvider,
 	username: HubUsername,
 	antiBotAssertion: AntiBotAssertion,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(effect.Schema.Struct({ totpCode: effect.Schema.optionalKey(TotpCode) }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({ totpCode: effect.Schema.optionalKey(TotpCode) }));
+strict$4(effect.Schema.Struct({
 	status: effect.Schema.Literal("connected"),
 	externalIdentity: ExternalIdentitySummary
 }));
-strict$3(effect.Schema.Struct({ totpCode: effect.Schema.optionalKey(TotpCode) }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({ totpCode: effect.Schema.optionalKey(TotpCode) }));
+strict$4(effect.Schema.Struct({
 	status: effect.Schema.Literal("disconnected"),
 	signedOut: effect.Schema.Boolean
 }));
 const ExternalIdentitySummaries = effect.Schema.Array(ExternalIdentitySummary).check(effect.Schema.isMaxLength(1), effect.Schema.makeFilter((identities) => new Set(identities.map((identity) => identity.provider)).size === identities.length ? void 0 : "external identity providers must be unique"));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	passwordConfigured: effect.Schema.Boolean,
 	totpEnrolled: effect.Schema.Boolean,
 	emailDeliveryConfigured: effect.Schema.Boolean,
-	email: effect.Schema.NullOr(strict$3(effect.Schema.Struct({
+	email: effect.Schema.NullOr(strict$4(effect.Schema.Struct({
 		address: HubNormalizedEmail,
 		verified: effect.Schema.Boolean
 	}))),
 	externalIdentities: ExternalIdentitySummaries
 }));
-const HubActiveSpaceSummary = strict$3(effect.Schema.Struct({
+const HubActiveSpaceSummary = strict$4(effect.Schema.Struct({
 	id: HubSpaceId,
 	kind: HubSpaceKind,
 	displayName: BoundedSpaceDisplayName,
 	role: HubSpaceRole
 }));
-const HubPublicAccount = strict$3(effect.Schema.Struct({
-	id: AccountId$1,
+const HubPublicAccount = strict$4(effect.Schema.Struct({
+	id: HubAccountId,
 	username: HubUsername,
 	displayName: BoundedDisplayName,
-	createdAt: EpochMs$1,
+	createdAt: EpochMs$2,
 	disabledAt: effect.Schema.Null
 }));
-const HubPublicBrowserSession = strict$3(effect.Schema.Struct({
+const HubPublicBrowserSession = strict$4(effect.Schema.Struct({
 	id: SessionId$1,
-	accountId: AccountId$1,
+	accountId: HubAccountId,
 	activeSpaceId: HubSpaceId,
-	createdAt: EpochMs$1,
-	expiresAt: EpochMs$1,
-	lastSeenAt: EpochMs$1,
+	createdAt: EpochMs$2,
+	expiresAt: EpochMs$2,
+	lastSeenAt: EpochMs$2,
 	revokedAt: effect.Schema.Null,
 	revocationReasonCode: effect.Schema.Null
 }).check(effect.Schema.makeFilter((session) => session.expiresAt > session.createdAt && session.lastSeenAt >= session.createdAt && session.lastSeenAt <= session.expiresAt ? void 0 : "browser session timestamps are inconsistent")));
@@ -926,11 +988,11 @@ function hubSessionIdentityConsistency(value) {
 	const matches = value.spaces.filter((space) => space.id === value.activeSpace.id);
 	return matches.length === 1 && matches[0]?.role === value.activeSpace.role ? void 0 : "active space must appear exactly once in spaces";
 }
-const HubBrowserSessionResponse = strict$3(effect.Schema.Struct({
+const HubBrowserSessionResponse = strict$4(effect.Schema.Struct({
 	...HubSessionIdentityFields,
 	csrfToken: effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(4096))
 }).check(effect.Schema.makeFilter(hubSessionIdentityConsistency)));
-const HubSessionIdentity = strict$3(effect.Schema.Struct(HubSessionIdentityFields).check(effect.Schema.makeFilter(hubSessionIdentityConsistency)));
+const HubSessionIdentity = strict$4(effect.Schema.Struct(HubSessionIdentityFields).check(effect.Schema.makeFilter(hubSessionIdentityConsistency)));
 const NativeIdentityAttemptId = effect.Schema.String.check(effect.Schema.isPattern(/^nident_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(50)).pipe(effect.Schema.brand("NativeIdentityAttemptId"));
 const NativeIdentityLoginAttemptId = effect.Schema.String.check(effect.Schema.isPattern(/^nlogin_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(50)).pipe(effect.Schema.brand("NativeIdentityLoginAttemptId"));
 const NativeIdentityResetAttemptId = effect.Schema.String.check(effect.Schema.isPattern(/^nreset_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(50)).pipe(effect.Schema.brand("NativeIdentityResetAttemptId"));
@@ -939,7 +1001,7 @@ const NativeIdentityTimedAttempt = {
 	attemptSecret: NativeIdentityAttemptSecret,
 	resendAfterMs: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(9e5))
 };
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	email: HubNormalizedEmail,
 	antiBotAssertion: AntiBotAssertion
 }));
@@ -947,14 +1009,14 @@ strictTimed({
 	status: effect.Schema.Literal("accepted"),
 	...NativeIdentityTimedAttempt
 });
-const NativeIdentityMailboxProof = effect.Schema.Union([strict$3(effect.Schema.Struct({
+const NativeIdentityMailboxProof = effect.Schema.Union([strict$4(effect.Schema.Struct({
 	kind: effect.Schema.Literal("link_token"),
 	token: MailToken
-})), strict$3(effect.Schema.Struct({
+})), strict$4(effect.Schema.Struct({
 	kind: effect.Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	attemptId: NativeIdentityAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	proof: NativeIdentityMailboxProof
@@ -972,41 +1034,41 @@ const NativeIdentityActivation = {
 	attemptId: NativeIdentityAttemptId,
 	activationSecret: NativeIdentityActivationSecret
 };
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	...NativeIdentityActivation,
 	username: HubUsername
 }));
-strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("claimed") }));
-strict$3(effect.Schema.Struct(NativeIdentityActivation));
-strict$3(effect.Schema.Struct({ options: JsonObject }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({ status: effect.Schema.Literal("claimed") }));
+strict$4(effect.Schema.Struct(NativeIdentityActivation));
+strict$4(effect.Schema.Struct({ options: JsonObject }));
+strict$4(effect.Schema.Struct({
 	...NativeIdentityActivation,
 	response: JsonObject,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	...NativeIdentityActivation,
 	password: BoundedPassword,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	status: effect.Schema.Literal("complete"),
 	identity: HubSessionIdentity,
 	token: NativeIdentitySessionToken
 }));
 const NativeIdentityRecoveryCodes = effect.Schema.Array(effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(512))).check(effect.Schema.isMinLength(1), effect.Schema.isMaxLength(256));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	status: effect.Schema.Literal("complete"),
 	identity: HubSessionIdentity,
 	token: NativeIdentitySessionToken,
 	recoveryCodes: NativeIdentityRecoveryCodes
 }));
-effect.Schema.Union([strict$3(effect.Schema.Struct({
+effect.Schema.Union([strict$4(effect.Schema.Struct({
 	kind: effect.Schema.Literal("username"),
 	username: HubUsername,
 	password: BoundedPassword,
 	antiBotAssertion: effect.Schema.optionalKey(AntiBotAssertion)
-})), strict$3(effect.Schema.Struct({
+})), strict$4(effect.Schema.Struct({
 	kind: effect.Schema.Literal("verified_email"),
 	...NativeIdentityActivation,
 	password: BoundedPassword
@@ -1017,22 +1079,22 @@ strictTimed({
 	attemptSecret: NativeIdentityAttemptSecret,
 	factor: effect.Schema.Literals(["totp", "email_code"])
 });
-effect.Schema.Union([strict$3(effect.Schema.Struct({
+effect.Schema.Union([strict$4(effect.Schema.Struct({
 	attemptId: NativeIdentityLoginAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	factor: effect.Schema.Literal("totp"),
 	code: TotpCode
-})), strict$3(effect.Schema.Struct({
+})), strict$4(effect.Schema.Struct({
 	attemptId: NativeIdentityLoginAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	factor: effect.Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	code: effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(512)),
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	identifier: HubLoginIdentifier,
 	antiBotAssertion: effect.Schema.optionalKey(AntiBotAssertion)
 }));
@@ -1042,7 +1104,7 @@ strictTimed({
 	attemptSecret: NativeIdentityAttemptSecret,
 	resendAfterMs: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(9e5))
 });
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	attemptId: NativeIdentityResetAttemptId,
 	attemptSecret: NativeIdentityAttemptSecret,
 	proof: NativeIdentityMailboxProof
@@ -1053,17 +1115,17 @@ strictTimed({
 	resetSecret: NativeIdentityResetSecret,
 	requiresTotp: effect.Schema.Boolean
 });
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	attemptId: NativeIdentityResetAttemptId,
 	resetSecret: NativeIdentityResetSecret,
 	password: BoundedPassword,
-	factor: effect.Schema.Union([strict$3(effect.Schema.Struct({ kind: effect.Schema.Literal("none") })), strict$3(effect.Schema.Struct({
+	factor: effect.Schema.Union([strict$4(effect.Schema.Struct({ kind: effect.Schema.Literal("none") })), strict$4(effect.Schema.Struct({
 		kind: effect.Schema.Literal("totp"),
 		code: TotpCode
 	}))])
 }));
-strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("complete") }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({ status: effect.Schema.Literal("complete") }));
+strict$4(effect.Schema.Struct({
 	attemptId: effect.Schema.Union([
 		NativeIdentityAttemptId,
 		NativeIdentityLoginAttemptId,
@@ -1071,9 +1133,9 @@ strict$3(effect.Schema.Struct({
 	]),
 	attemptSecret: effect.Schema.Union([NativeIdentityAttemptSecret, NativeIdentityActivationSecret])
 }));
-strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("cancelled") }));
+strict$4(effect.Schema.Struct({ status: effect.Schema.Literal("cancelled") }));
 const PublicSignupAttemptId = effect.Schema.String.check(effect.Schema.isPattern(/^signup_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(50)).pipe(effect.Schema.brand("PublicSignupAttemptId"));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	username: HubUsername,
 	email: HubNormalizedEmail,
 	antiBotAssertion: AntiBotAssertion,
@@ -1085,14 +1147,14 @@ strictTimed({
 	attemptSecret: SignupAttemptSecret,
 	resendAfterMs: effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(9e5))
 });
-const PublicSignupMailboxProof = effect.Schema.Union([strict$3(effect.Schema.Struct({
+const PublicSignupMailboxProof = effect.Schema.Union([strict$4(effect.Schema.Struct({
 	kind: effect.Schema.Literal("link_token"),
 	token: MailToken
-})), strict$3(effect.Schema.Struct({
+})), strict$4(effect.Schema.Struct({
 	kind: effect.Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	attemptId: PublicSignupAttemptId,
 	attemptSecret: SignupAttemptSecret,
 	proof: PublicSignupMailboxProof
@@ -1106,26 +1168,26 @@ const PublicSignupActivation = {
 	attemptId: PublicSignupAttemptId,
 	activationSecret: SignupActivationSecret
 };
-strict$3(effect.Schema.Struct(PublicSignupActivation));
-strict$3(effect.Schema.Struct({ options: JsonObject }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct(PublicSignupActivation));
+strict$4(effect.Schema.Struct({ options: JsonObject }));
+strict$4(effect.Schema.Struct({
 	...PublicSignupActivation,
 	response: JsonObject,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	...PublicSignupActivation,
 	password: BoundedPassword,
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	status: effect.Schema.Literal("complete"),
 	identity: HubBrowserSessionResponse,
 	recoveryCodes: effect.Schema.Array(effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(512))).check(effect.Schema.isMinLength(1), effect.Schema.isMaxLength(256))
 }));
 const PasswordLoginAttemptId = effect.Schema.String.check(effect.Schema.isPattern(/^login_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(49)).pipe(effect.Schema.brand("PasswordLoginAttemptId"));
 const PasswordLoginFactor = effect.Schema.Literals(["totp", "email_code"]);
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	identifier: HubLoginIdentifier,
 	password: BoundedPassword,
 	antiBotAssertion: effect.Schema.optional(AntiBotAssertion)
@@ -1136,43 +1198,43 @@ strictTimed({
 	attemptSecret: PasswordLoginAttemptSecret,
 	factor: PasswordLoginFactor
 });
-effect.Schema.Union([strict$3(effect.Schema.Struct({
+effect.Schema.Union([strict$4(effect.Schema.Struct({
 	attemptId: PasswordLoginAttemptId,
 	attemptSecret: PasswordLoginAttemptSecret,
 	factor: effect.Schema.Literal("totp"),
 	code: TotpCode
-})), strict$3(effect.Schema.Struct({
+})), strict$4(effect.Schema.Struct({
 	attemptId: PasswordLoginAttemptId,
 	attemptSecret: PasswordLoginAttemptSecret,
 	factor: effect.Schema.Literal("email_code"),
 	code: EmailCode
 }))]);
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	identifier: HubLoginIdentifier,
 	antiBotAssertion: effect.Schema.optional(AntiBotAssertion)
 }));
-strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("accepted") }));
+strict$4(effect.Schema.Struct({ status: effect.Schema.Literal("accepted") }));
 const PasswordResetAttemptId = effect.Schema.String.check(effect.Schema.isPattern(/^reset_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(49)).pipe(effect.Schema.brand("PasswordResetAttemptId"));
-strict$3(effect.Schema.Struct({ token: MailToken }));
+strict$4(effect.Schema.Struct({ token: MailToken }));
 strictTimed({
 	status: effect.Schema.Literal("verified"),
 	attemptId: PasswordResetAttemptId,
 	attemptSecret: PasswordResetAttemptSecret,
 	requiresTotp: effect.Schema.Boolean
 });
-const PasswordResetFactor = effect.Schema.Union([strict$3(effect.Schema.Struct({ kind: effect.Schema.Literal("none") })), strict$3(effect.Schema.Struct({
+const PasswordResetFactor = effect.Schema.Union([strict$4(effect.Schema.Struct({ kind: effect.Schema.Literal("none") })), strict$4(effect.Schema.Struct({
 	kind: effect.Schema.Literal("totp"),
 	code: TotpCode
 }))]);
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	attemptId: PasswordResetAttemptId,
 	attemptSecret: PasswordResetAttemptSecret,
 	password: BoundedPassword,
 	factor: PasswordResetFactor
 }));
-strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("complete") }));
-strict$3(effect.Schema.Struct({ spaceId: HubSpaceId }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({ status: effect.Schema.Literal("complete") }));
+strict$4(effect.Schema.Struct({ spaceId: HubSpaceId }));
+strict$4(effect.Schema.Struct({
 	activeSpace: HubActiveSpaceSummary,
 	spaces: HubSpaces
 }).check(effect.Schema.makeFilter((value) => {
@@ -1184,7 +1246,7 @@ const DesktopInstallationId = effect.Schema.String.check(effect.Schema.isPattern
 const NativeNodeClaimId = effect.Schema.String.check(effect.Schema.isPattern(/^nclaim_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(50)).pipe(effect.Schema.brand("NativeNodeClaimId"));
 const NativeNodeClaimEnvironmentId = effect.Schema.String.check(effect.Schema.isPattern(/^env_[A-Za-z0-9_-]{22}$/), effect.Schema.isMaxLength(26)).pipe(effect.Schema.brand("NativeNodeClaimEnvironmentId"));
 const NativeNodeClaimPublicKey = effect.Schema.String.check(effect.Schema.isMinLength(43), effect.Schema.isMaxLength(43), effect.Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/)).pipe(effect.Schema.brand("NativeNodeClaimPublicKey"));
-const NativeNodeClaimMetadata = strict$3(effect.Schema.Struct({
+const NativeNodeClaimMetadata = strict$4(effect.Schema.Struct({
 	environmentId: NativeNodeClaimEnvironmentId,
 	label: effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(100)),
 	platformOs: effect.Schema.Literals([
@@ -1203,7 +1265,7 @@ const NativeNodeClaimMetadata = strict$3(effect.Schema.Struct({
 	publicKey: NativeNodeClaimPublicKey,
 	fingerprint: HubNodePublicKeyFingerprint
 }));
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	installationId: DesktopInstallationId,
 	node: NativeNodeClaimMetadata
 }));
@@ -1212,7 +1274,7 @@ const NativeNodeClaimStartResponse = strictTimed({
 	transcriptVersion: effect.Schema.Literal(1),
 	claimId: NativeNodeClaimId,
 	challenge: Opaque256,
-	accountId: AccountId$1,
+	accountId: HubAccountId,
 	spaceId: HubSpaceId,
 	sessionId: SessionId$1,
 	dpopKeyThumbprint: Opaque256,
@@ -1220,16 +1282,16 @@ const NativeNodeClaimStartResponse = strictTimed({
 	environmentId: NativeNodeClaimEnvironmentId,
 	nodeFingerprint: HubNodePublicKeyFingerprint
 });
-strict$3(effect.Schema.Struct({
+strict$4(effect.Schema.Struct({
 	claimId: NativeNodeClaimId,
 	challenge: Opaque256,
 	signature: effect.Schema.String.check(effect.Schema.isMinLength(86), effect.Schema.isMaxLength(86), effect.Schema.isPattern(/^[A-Za-z0-9_-]{85}[AQgw]$/)),
-	idempotencyKey: IdempotencyKey
+	idempotencyKey: IdempotencyKey$1
 }));
-const NativeNodeClaimFinishResponse = strict$3(effect.Schema.Struct({
+const NativeNodeClaimFinishResponse = strict$4(effect.Schema.Struct({
 	status: effect.Schema.Literal("claimed"),
 	disposition: effect.Schema.Literals(["created", "reconnected"]),
-	node: strict$3(effect.Schema.Struct({
+	node: strict$4(effect.Schema.Struct({
 		id: RelayNodeId,
 		activeKeyId: effect.Schema.String.check(effect.Schema.isPattern(/^nkey_[A-Za-z0-9_-]{22}$/), effect.Schema.isMaxLength(27)),
 		environmentId: NativeNodeClaimEnvironmentId,
@@ -1238,10 +1300,10 @@ const NativeNodeClaimFinishResponse = strict$3(effect.Schema.Struct({
 		effectiveRole: effect.Schema.Literal("owner")
 	}))
 }));
-effect.Schema.Union([strict$3(effect.Schema.Struct({
+effect.Schema.Union([strict$4(effect.Schema.Struct({
 	error: effect.Schema.Literal("node_claim_rejected"),
 	retryable: effect.Schema.Literal(false)
-})), strict$3(effect.Schema.Struct({
+})), strict$4(effect.Schema.Struct({
 	error: effect.Schema.Literal("node_claim_unavailable"),
 	retryable: effect.Schema.Literal(true),
 	retryAfterMs: effect.Schema.optional(effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(3e5)))
@@ -1253,7 +1315,7 @@ const NATIVE_HANDOFF_CALLBACK_URIS = [
 	"ryco://hosted/complete"
 ];
 const NATIVE_HANDOFF_MAX_URL_CHARS = 2048;
-const strict$2 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
+const strict$3 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
 const Base64Url256$1 = effect.Schema.String.check(effect.Schema.isMinLength(43), effect.Schema.isMaxLength(43), effect.Schema.isPattern(/^[A-Za-z0-9_-]{43}$/));
 const isBase64Url256 = effect.Schema.is(Base64Url256$1);
 const NativeHandoffId = Base64Url256$1.pipe(effect.Schema.brand("NativeHandoffId"));
@@ -1262,7 +1324,7 @@ const NativeHandoffCode = Base64Url256$1.pipe(effect.Schema.brand("NativeHandoff
 const NativeHandoffCodeVerifier = Base64Url256$1.pipe(effect.Schema.brand("NativeHandoffCodeVerifier"));
 const NativeHandoffCodeChallenge = Base64Url256$1.pipe(effect.Schema.brand("NativeHandoffCodeChallenge"));
 const NativeHandoffCallbackUri = effect.Schema.Literals(NATIVE_HANDOFF_CALLBACK_URIS);
-const EpochMs = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0));
+const EpochMs$1 = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0));
 const BoundedDeviceLabel = effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(64));
 const RelyingPartyId = effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(253), effect.Schema.isPattern(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/i));
 const DisplayName = effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(64));
@@ -1274,28 +1336,28 @@ const NativeIdentityLoginMethod = effect.Schema.Literals([
 	"recovery_code"
 ]);
 const uniqueNonEmpty = (item, maximum) => effect.Schema.Array(item).check(effect.Schema.isMinLength(1), effect.Schema.isMaxLength(maximum), effect.Schema.makeFilter((values) => new Set(values).size === values.length ? void 0 : "values must be unique"));
-const NativeIdentityAntiBot = effect.Schema.Union([strict$2(effect.Schema.Struct({ provider: effect.Schema.Literal("bypass") })), strict$2(effect.Schema.Struct({
+const NativeIdentityAntiBot = effect.Schema.Union([strict$3(effect.Schema.Struct({ provider: effect.Schema.Literal("bypass") })), strict$3(effect.Schema.Struct({
 	provider: effect.Schema.Literal("turnstile"),
 	siteKey: NativeIdentityTurnstileSiteKey
 }))]);
-const NativeIdentityCapability = strict$2(effect.Schema.Struct({
+const NativeIdentityCapability = strict$3(effect.Schema.Struct({
 	version: effect.Schema.Literal(2),
-	email: strict$2(effect.Schema.Struct({
+	email: strict$3(effect.Schema.Struct({
 		verification: effect.Schema.Literal("required"),
 		antiBot: NativeIdentityAntiBot
 	})),
-	signup: effect.Schema.Union([strict$2(effect.Schema.Struct({ status: effect.Schema.Literal("disabled") })), strict$2(effect.Schema.Struct({
+	signup: effect.Schema.Union([strict$3(effect.Schema.Struct({ status: effect.Schema.Literal("disabled") })), strict$3(effect.Schema.Struct({
 		status: effect.Schema.Literal("enabled"),
 		primaryCredentials: uniqueNonEmpty(NativeIdentityPrimaryCredential, 2)
 	}))]),
-	login: strict$2(effect.Schema.Struct({
+	login: strict$3(effect.Schema.Struct({
 		methods: uniqueNonEmpty(NativeIdentityLoginMethod, 3),
-		passwordSecondFactor: strict$2(effect.Schema.Struct({
+		passwordSecondFactor: strict$3(effect.Schema.Struct({
 			totp: effect.Schema.Literal("when_enrolled"),
 			fallback: effect.Schema.Literal("verified_email_code")
 		}))
 	})),
-	recovery: strict$2(effect.Schema.Struct({
+	recovery: strict$3(effect.Schema.Struct({
 		recoveryCode: effect.Schema.Boolean,
 		passwordReset: effect.Schema.Boolean
 	}))
@@ -1344,29 +1406,29 @@ function validCallbackResponse(value, outcome) {
 }
 const ApprovedCallbackUrl = effect.Schema.String.check(effect.Schema.makeFilter((value) => validCallbackResponse(value, "approved") ? void 0 : "invalid approved callback URL"));
 const CancelledCallbackUrl = effect.Schema.String.check(effect.Schema.makeFilter((value) => validCallbackResponse(value, "cancelled") ? void 0 : "invalid cancelled callback URL"));
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({
 	service: effect.Schema.Literal("ryco-hub"),
 	protocolVersion: effect.Schema.Literal(1),
-	nativeHandoff: strict$2(effect.Schema.Struct({
+	nativeHandoff: strict$3(effect.Schema.Struct({
 		mode: effect.Schema.Literal(NATIVE_HANDOFF_MODE),
 		version: effect.Schema.Literal(1)
 	})),
-	relyingParty: strict$2(effect.Schema.Struct({
+	relyingParty: strict$3(effect.Schema.Struct({
 		id: RelyingPartyId,
 		displayName: DisplayName
 	})),
 	nativeIdentity: effect.Schema.optionalKey(NativeIdentityCapability)
 }));
-const NativeHandoffSignInPurpose = strict$2(effect.Schema.Struct({
+const NativeHandoffSignInPurpose = strict$3(effect.Schema.Struct({
 	kind: effect.Schema.Literal("sign_in"),
 	providerHint: effect.Schema.optionalKey(ExternalIdentityProvider)
 }));
-const NativeHandoffConnectExternalIdentityPurpose = strict$2(effect.Schema.Struct({
+const NativeHandoffConnectExternalIdentityPurpose = strict$3(effect.Schema.Struct({
 	kind: effect.Schema.Literal("connect_external_identity"),
 	provider: ExternalIdentityProvider
 }));
 const NativeHandoffPurpose = effect.Schema.Union([NativeHandoffSignInPurpose, NativeHandoffConnectExternalIdentityPurpose]);
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({
 	redirectUri: NativeHandoffCallbackUri,
 	codeChallenge: NativeHandoffCodeChallenge,
 	codeChallengeMethod: effect.Schema.Literal("S256"),
@@ -1374,25 +1436,25 @@ strict$2(effect.Schema.Struct({
 	deviceLabel: BoundedDeviceLabel,
 	purpose: effect.Schema.optionalKey(NativeHandoffPurpose)
 }));
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({
 	handoffId: NativeHandoffId,
 	authorizationUrl: AuthorizationUrl,
-	expiresAt: EpochMs
+	expiresAt: EpochMs$1
 }));
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({
 	status: effect.Schema.Literal("pending"),
 	deviceLabel: BoundedDeviceLabel,
-	expiresAt: EpochMs,
+	expiresAt: EpochMs$1,
 	providerHint: effect.Schema.optionalKey(ExternalIdentityProvider)
 }));
-strict$2(effect.Schema.Struct({ redirectUri: ApprovedCallbackUrl }));
-strict$2(effect.Schema.Struct({ redirectUri: CancelledCallbackUrl }));
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({ redirectUri: ApprovedCallbackUrl }));
+strict$3(effect.Schema.Struct({ redirectUri: CancelledCallbackUrl }));
+strict$3(effect.Schema.Struct({
 	handoffId: NativeHandoffId,
 	code: NativeHandoffCode,
 	codeVerifier: NativeHandoffCodeVerifier
 }));
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({
 	handoffId: NativeHandoffId,
 	code: NativeHandoffCode,
 	codeVerifier: NativeHandoffCodeVerifier,
@@ -1403,7 +1465,7 @@ const AccountId = effect.Schema.String.check(effect.Schema.isPattern(/^acct_[A-Z
 const SessionId = effect.Schema.String.check(effect.Schema.isPattern(/^sess_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(48));
 const SessionFamilyId = effect.Schema.String.check(effect.Schema.isPattern(/^sfam_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(48));
 const NullableSessionLabel = effect.Schema.NullOr(effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(64)));
-const NativeHandoffAccount = strict$2(effect.Schema.Struct({
+const NativeHandoffAccount = strict$3(effect.Schema.Struct({
 	id: AccountId,
 	displayName: effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(200)),
 	role: effect.Schema.Literals([
@@ -1411,32 +1473,241 @@ const NativeHandoffAccount = strict$2(effect.Schema.Struct({
 		"operator",
 		"owner"
 	]),
-	createdAt: EpochMs,
+	createdAt: EpochMs$1,
 	disabledAt: effect.Schema.Null
 }));
-const NativeHandoffSession = strict$2(effect.Schema.Struct({
+const NativeHandoffSession = strict$3(effect.Schema.Struct({
 	id: SessionId,
 	accountId: AccountId,
 	familyId: SessionFamilyId,
 	clientLabel: NullableSessionLabel,
 	kind: effect.Schema.Literal("native"),
-	createdAt: EpochMs,
-	expiresAt: EpochMs,
-	lastSeenAt: EpochMs,
+	createdAt: EpochMs$1,
+	expiresAt: EpochMs$1,
+	lastSeenAt: EpochMs$1,
 	replacedBySessionId: effect.Schema.Null,
 	revokedAt: effect.Schema.Null,
 	revocationReasonCode: effect.Schema.Null
 }).check(effect.Schema.makeFilter((session) => session.expiresAt > session.createdAt && session.lastSeenAt >= session.createdAt && session.lastSeenAt <= session.expiresAt ? void 0 : "native session timestamps are inconsistent")));
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({
 	account: NativeHandoffAccount,
 	session: NativeHandoffSession,
 	token: Base64Url256$1
 }).check(effect.Schema.makeFilter((value) => value.session.accountId === value.account.id ? void 0 : "native session account does not match")));
-strict$2(effect.Schema.Struct({
+strict$3(effect.Schema.Struct({
 	status: effect.Schema.Literal("connected"),
 	purpose: NativeHandoffConnectExternalIdentityPurpose,
 	externalIdentity: ExternalIdentitySummary
 }));
+const NATIVE_E2EE_MAX_GRANT_KEYS = 4;
+const HUB_DEVICE_GRANT_MAX_BYTES = 2048;
+const HUB_DEVICE_GRANT_BASE64URL_MAX_CHARS = 2731;
+const CLIENT_PREKEY_CERTIFICATE_BASE64URL_MAX_CHARS = 1459;
+const NODE_E2EE_CAPABILITY_STATEMENT_BASE64URL_MAX_CHARS = 6920;
+const strict$2 = (schema) => schema.annotate({ parseOptions: { onExcessProperty: "error" } });
+const UInt32 = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(4294967295));
+const EpochMs = effect.Schema.Int.check(effect.Schema.isGreaterThanOrEqualTo(0), effect.Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER));
+const ExactBytes = (length) => effect.Schema.Uint8Array.check(effect.Schema.isMinLength(length), effect.Schema.isMaxLength(length));
+const Base64Url = (minimum, maximum) => effect.Schema.String.check(effect.Schema.isMinLength(minimum), effect.Schema.isMaxLength(maximum), effect.Schema.isPattern(/^[A-Za-z0-9_-]+$/), effect.Schema.makeFilter((value) => value.length % 4 === 1 ? "invalid unpadded base64url length" : void 0));
+const Base64Url32 = Base64Url(43, 43);
+const Base64UrlP256 = Base64Url(87, 87);
+const HubDeviceGrantId = effect.Schema.String.check(effect.Schema.isPattern(/^hgr_[A-Za-z0-9_-]{22,43}$/), effect.Schema.isMaxLength(47)).pipe(effect.Schema.brand("HubDeviceGrantId"));
+const NodeE2eeContinuityId = effect.Schema.String.check(effect.Schema.isPattern(/^nct_[A-Za-z0-9_-]{22}$/), effect.Schema.isMaxLength(26)).pipe(effect.Schema.brand("NodeE2eeContinuityId"));
+const NativeE2eePlatform = effect.Schema.Literals([
+	"darwin",
+	"linux",
+	"windows",
+	"ios",
+	"android"
+]);
+const NativeE2eeReportedKeyBacking = effect.Schema.Literals([
+	"secure-enclave",
+	"strongbox",
+	"tee",
+	"tpm",
+	"hardware-backed",
+	"unavailable"
+]);
+const NativeE2eeUsableKeyBacking = effect.Schema.Literals([
+	"secure-enclave",
+	"strongbox",
+	"tee",
+	"tpm",
+	"hardware-backed"
+]);
+const NativeE2eeEnrollmentStatus = effect.Schema.Literals([
+	"active",
+	"revoked",
+	"superseded"
+]);
+effect.Schema.Literals([
+	"locally-verified",
+	"account-enrolled",
+	"web-unsigned"
+]);
+const NodeE2eeAdmissionPolicy = effect.Schema.Literals([
+	"compatibility",
+	"require-e2ee",
+	"require-native-e2ee",
+	"require-locally-approved-native-e2ee"
+]);
+const HubDeviceGrantEnvelope = Base64Url(1, HUB_DEVICE_GRANT_BASE64URL_MAX_CHARS).pipe(effect.Schema.brand("HubDeviceGrantEnvelope"));
+const E2eeDigestBase64Url = Base64Url32.pipe(effect.Schema.brand("E2eeDigestBase64Url"));
+const BoundedCapabilities = effect.Schema.Array(RelayCapability).check(effect.Schema.isMinLength(1), effect.Schema.isMaxLength(32), effect.Schema.makeFilter((values) => new Set(values).size === values.length ? void 0 : "capabilities must be distinct"));
+const HubOrigin = effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(128), effect.Schema.isPattern(/^https?:\/\/[^\s/]+$/));
+const DeviceLabel = effect.Schema.Trim.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(100));
+const AppVersion = effect.Schema.String.check(effect.Schema.isNonEmpty(), effect.Schema.isMaxLength(64));
+const IdempotencyKey = Base64Url32.pipe(effect.Schema.brand("NativeE2eeIdempotencyKey"));
+const ReasonCode = effect.Schema.String.check(effect.Schema.isMinLength(1), effect.Schema.isMaxLength(64), effect.Schema.isPattern(/^[a-z][a-z0-9_]*$/));
+const HubDeviceGrantClaims = strict$2(effect.Schema.Struct({
+	version: effect.Schema.Literal(1),
+	suiteId: effect.Schema.Literal(2),
+	issuerHubOrigin: HubOrigin,
+	keyId: HubGrantVerificationKeyId,
+	grantId: HubDeviceGrantId,
+	accountId: HubAccountId,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	deviceAuthEpoch: E2eeAuthorizationEpoch,
+	deviceIdentityAlgorithm: effect.Schema.Literal("p256"),
+	deviceIdentityPublicKey: ExactBytes(65),
+	deviceIdentityFingerprint: ExactBytes(32),
+	deviceAgreementAlgorithm: effect.Schema.Literal("x25519"),
+	deviceAgreementPublicKey: ExactBytes(32),
+	deviceAgreementFingerprint: ExactBytes(32),
+	clientPrekeyCertificateDigest: ExactBytes(32),
+	nodeId: RelayNodeId,
+	nodeIdentityAlgorithm: effect.Schema.Literal("ed25519"),
+	nodeIdentityPublicKey: ExactBytes(32),
+	nodeIdentityFingerprint: ExactBytes(32),
+	nodeAgreementAlgorithm: effect.Schema.Literal("x25519"),
+	nodeAgreementPublicKey: ExactBytes(32),
+	nodeAgreementFingerprint: ExactBytes(32),
+	nodeContinuityId: NodeE2eeContinuityId,
+	nodePolicyGeneration: UInt32,
+	nodeCapabilityStatementDigest: ExactBytes(32),
+	relayTicketId: RelayTicketId,
+	maximumRole: RelayEffectiveRole,
+	capabilities: BoundedCapabilities,
+	issuedAt: EpochMs,
+	notBefore: EpochMs,
+	expiresAt: EpochMs,
+	nonce: ExactBytes(32)
+}).check(effect.Schema.makeFilter((claims) => claims.notBefore <= claims.issuedAt && claims.issuedAt < claims.expiresAt && claims.expiresAt - claims.issuedAt <= 12e4 ? void 0 : "invalid grant validity interval")));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	hubOrigin: HubOrigin,
+	accountId: HubAccountId,
+	enrollmentId: NativeE2eeEnrollmentId,
+	expectedEnrollmentRevision: effect.Schema.optionalKey(UInt32),
+	identityPublicKey: Base64UrlP256,
+	identityFingerprint: Base64Url32,
+	agreementPublicKey: Base64Url32,
+	agreementFingerprint: Base64Url32,
+	clientPrekeyCertificate: Base64Url(1, CLIENT_PREKEY_CERTIFICATE_BASE64URL_MAX_CHARS),
+	clientPrekeyCertificateDigest: Base64Url32,
+	certificateExpiresAt: EpochMs,
+	platform: NativeE2eePlatform,
+	appVersion: AppVersion,
+	reportedKeyBacking: NativeE2eeUsableKeyBacking,
+	deviceLabel: DeviceLabel,
+	requestedMaximumRole: RelayEffectiveRole,
+	requestedCapabilities: BoundedCapabilities,
+	enrollmentNonce: Base64Url32,
+	idempotencyKey: IdempotencyKey
+}));
+const AccountE2eeDeviceSummary = strict$2(effect.Schema.Struct({
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	deviceAuthEpoch: E2eeAuthorizationEpoch,
+	platform: NativeE2eePlatform,
+	appVersion: AppVersion,
+	reportedKeyBacking: NativeE2eeReportedKeyBacking,
+	deviceLabel: DeviceLabel,
+	identityFingerprint: Base64Url32,
+	agreementFingerprint: Base64Url32,
+	clientPrekeyCertificateDigest: Base64Url32,
+	certificateExpiresAt: EpochMs,
+	status: NativeE2eeEnrollmentStatus,
+	createdAt: EpochMs,
+	updatedAt: EpochMs,
+	lastUsedAt: effect.Schema.NullOr(EpochMs),
+	revokedAt: effect.Schema.NullOr(EpochMs)
+}).check(effect.Schema.makeFilter((device) => {
+	if (device.updatedAt < device.createdAt) return "updatedAt must not precede createdAt";
+	if (device.lastUsedAt !== null && device.lastUsedAt < device.createdAt) return "lastUsedAt must not precede createdAt";
+	if (device.revokedAt !== null && device.revokedAt < device.createdAt) return "revokedAt must not precede createdAt";
+	if (device.status === "active" && device.revokedAt !== null) return "active enrollment cannot have revokedAt";
+	if (device.status !== "active" && device.revokedAt === null) return "inactive enrollment requires revokedAt";
+})));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	enrollment: AccountE2eeDeviceSummary
+}));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	devices: effect.Schema.Array(AccountE2eeDeviceSummary).check(effect.Schema.isMaxLength(128), effect.Schema.makeFilter((devices) => new Set(devices.map((device) => `${device.enrollmentId}:${device.enrollmentRevision}`)).size === devices.length ? void 0 : "device enrollment revisions must be distinct"))
+}));
+strict$2(effect.Schema.Struct({
+	expectedEnrollmentRevision: NativeE2eeEnrollmentRevision,
+	deviceLabel: DeviceLabel
+}));
+strict$2(effect.Schema.Struct({
+	expectedEnrollmentRevision: NativeE2eeEnrollmentRevision,
+	reasonCode: ReasonCode
+}));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	enrollment: AccountE2eeDeviceSummary
+}));
+const HubGrantVerificationKey = strict$2(effect.Schema.Struct({
+	keyId: HubGrantVerificationKeyId,
+	publicKey: Base64Url32,
+	notBefore: EpochMs,
+	notAfter: EpochMs
+}).check(effect.Schema.makeFilter((key) => key.notAfter > key.notBefore ? void 0 : "notAfter must be after notBefore")));
+const HubGrantVerificationKeys = effect.Schema.Array(HubGrantVerificationKey).check(effect.Schema.isMinLength(1), effect.Schema.isMaxLength(NATIVE_E2EE_MAX_GRANT_KEYS), effect.Schema.makeFilter((keys) => new Set(keys.map((key) => key.keyId)).size === keys.length ? void 0 : "grant verification key ids must be distinct"));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	generation: E2eeKeysetGeneration,
+	keys: HubGrantVerificationKeys
+}));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	nodeId: RelayNodeId,
+	capability: RelayCapability,
+	protocolMajor: effect.Schema.Literal(1),
+	protocolMinor: effect.Schema.Literal(3),
+	suiteId: effect.Schema.Literal(2),
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	clientPrekeyCertificateDigest: Base64Url32
+}));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	ticket: Base64Url(43, 86),
+	ticketId: RelayTicketId,
+	expiresAt: EpochMs,
+	protocolMajor: effect.Schema.Literal(1),
+	protocolMinor: effect.Schema.Literal(3),
+	suiteId: effect.Schema.Literal(2),
+	deviceGrant: HubDeviceGrantEnvelope,
+	deviceGrantDigest: E2eeDigestBase64Url,
+	nodeCapabilityStatement: Base64Url(1, NODE_E2EE_CAPABILITY_STATEMENT_BASE64URL_MAX_CHARS),
+	nodeCapabilityStatementDigest: E2eeDigestBase64Url,
+	keysetGeneration: E2eeKeysetGeneration,
+	capability: RelayCapability,
+	effectiveRole: RelayEffectiveRole
+}));
+strict$2(effect.Schema.Struct({
+	protocolVersion: effect.Schema.Literal(1),
+	enrollmentId: NativeE2eeEnrollmentId,
+	enrollmentRevision: NativeE2eeEnrollmentRevision,
+	accountAuthEpoch: E2eeAuthorizationEpoch,
+	deviceAuthEpoch: E2eeAuthorizationEpoch
+}));
 const LOCAL_INTRODUCTION_DESCRIPTOR_PATH = "/api/desktop/e2ee/local-introduction/descriptor";
 const LOCAL_INTRODUCTION_COMPLETE_PATH = "/api/desktop/e2ee/local-introduction/complete";
 const LOCAL_INTRODUCTION_CONTROL_HEADER = "x-ryco-desktop-control";
@@ -12836,12 +13107,24 @@ Object.defineProperty(exports, "GrokSettings", {
 		return GrokSettings;
 	}
 });
+Object.defineProperty(exports, "HUB_DEVICE_GRANT_MAX_BYTES", {
+	enumerable: true,
+	get: function() {
+		return HUB_DEVICE_GRANT_MAX_BYTES;
+	}
+});
 Object.defineProperty(exports, "HubConnectorStatus", {
 	enumerable: true,
 	get: function() {
 		return HubConnectorStatus;
 	}
 });
+Object.defineProperty(exports, "HubDeviceGrantClaims", {
+	enumerable: true,
+	get: function() {
+		return HubDeviceGrantClaims;
+	}
+});
 Object.defineProperty(exports, "HubEnrollmentCeremonyDetail", {
 	enumerable: true,
 	get: function() {
@@ -12854,6 +13137,12 @@ Object.defineProperty(exports, "HubEnrollmentStartResult", {
 		return HubEnrollmentStartResult;
 	}
 });
+Object.defineProperty(exports, "HubGrantVerificationKeyId", {
+	enumerable: true,
+	get: function() {
+		return HubGrantVerificationKeyId;
+	}
+});
 Object.defineProperty(exports, "HubIdentitySummary", {
 	enumerable: true,
 	get: function() {
@@ -13028,6 +13317,18 @@ Object.defineProperty(exports, "ModelSelection", {
 		return ModelSelection;
 	}
 });
+Object.defineProperty(exports, "NATIVE_E2EE_MAX_GRANT_KEYS", {
+	enumerable: true,
+	get: function() {
+		return NATIVE_E2EE_MAX_GRANT_KEYS;
+	}
+});
+Object.defineProperty(exports, "NodeE2eeAdmissionPolicy", {
+	enumerable: true,
+	get: function() {
+		return NodeE2eeAdmissionPolicy;
+	}
+});
 Object.defineProperty(exports, "NonNegativeInt", {
 	enumerable: true,
 	get: function() {