wire-mesh-core 1.18.0 → 1.19.0

package/dist/domain/tokens.mjs

@@ -1,310 +1,2 @@
-import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
-import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
-//#region src/domain/tokens.ts
-function bytesEqual(a, b) {
-	if (a.length !== b.length) return false;
-	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
-	return true;
-}
-/** True when the path contains a "." or ".." segment. Purely lexical prefix comparison would let "/work/../org" pass under "/work" -- a path that normalises outside the parent -- so any relative segment fails the narrowing comparison wholesale: fail-closed rather than reimplementing path normalisation, consistent with how empty, case-different, and non-boundary-prefixed paths already behave. */
-function hasRelativeSegment(path) {
-	return path.split("/").some((segment) => segment === "." || segment === "..");
-}
-/** True when childPath is parentPath or a descendant of it, compared on "/"-segment boundaries: "/work/sub" narrows "/work", but "/workbook" does NOT narrow "/work" despite the string prefix, because "book" continues the same segment. Paths containing "." or ".." segments never narrow anything (see hasRelativeSegment). */
-function pathNarrows(childPath, parentPath) {
-	if (hasRelativeSegment(childPath) || hasRelativeSegment(parentPath)) return false;
-	if (childPath === parentPath) return true;
-	if (!childPath.startsWith(parentPath)) return false;
-	if (parentPath.endsWith("/")) return true;
-	return childPath.charAt(parentPath.length) === "/";
-}
-/**
-* True when childScope narrows parentScope per tokens.cddl ("each hop can only narrow authority, never widen it"): the kind must be identical (a different kind is a different kind of authority, not a narrower one), and a parent with a path requires the child to carry an equal-or-descendant path -- an absent child path means the kind's whole-scope root, which is wider than any path-narrowed parent. A parent with no path (whole-scope root) lets any child path under the same kind through. Exported for capability-grant.ts's own obligation 4 (an unsolicited push's embedded token must equal-or-root the enclosing request's own scope), which is exactly this same narrowing relation applied outside a delegation chain.
-*/
-function scopeNarrows(parent, child) {
-	if (parent.kind !== child.kind) return false;
-	if (parent.path === void 0) return true;
-	if (child.path === void 0) return false;
-	return pathNarrows(child.path, parent.path);
-}
-/** RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD: ["Signature1", protected, external_aad, payload]. */
-function sig1ToBeSigned(protectedHeader, payload) {
-	return encode([
-		"Signature1",
-		protectedHeader,
-		/* @__PURE__ */ new Uint8Array(0),
-		payload
-	], cdeEncodeOptions);
-}
-/** Normalises cbor2's encode() (and any other Uint8Array<ArrayBufferLike>-typed construction) to a fresh, non-shared, whole-buffer Uint8Array<ArrayBuffer> -- what the generated schemas' concrete-typed fields require. */
-function buf(bytes) {
-	return Uint8Array.from(bytes);
-}
-function encodeBuf(value) {
-	return buf(encode(value, cdeEncodeOptions));
-}
-/** The COSE protected header every capability-token/revocation-entry envelope in this codebase actually signs over: label 1 (alg) and label 4 (kid, the issuer's own device-id) -- matching the frozen conformance vectors, not the empty header a token merely needs to verify against itself. */
-function protectedHeaderFor(identity) {
-	return encodeBuf({
-		1: identity.identityKey.alg,
-		4: identity.deviceId
-	});
-}
-/** Decodes and validates a parent token's own claims from its raw CapabilityToken tuple -- the same decode `verifyTokenChain` performs on `claims.parent`, extracted here so mint can check narrowing against a parent's real claims without duplicating the CBOR/schema plumbing. Returns undefined for anything that doesn't parse; the caller turns that into its own refusal reason since "malformed" means something different at mint time than at verify time. */
-function decodeTokenClaims(token) {
-	const [, , payload] = token;
-	if (payload === null) return void 0;
-	let decoded;
-	try {
-		decoded = decode(payload, cdeDecodeOptions);
-	} catch {
-		return;
-	}
-	const result = tokenClaimsSchema.safeParse(decoded);
-	return result.success ? result.data : void 0;
-}
-/**
-* Verifies one capability token per tokens.cddl's own documented rules: the token is a well-formed COSE_Sign1 whose signature actually verifies against its own embedded issuer-key, that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id -- no shared secret needed to check this), the token is currently valid (not expired, not before not-before, not revoked by its own issuer), and -- recursively -- any parent delegation narrows rather than widens across all three axes of authority: the parent's bearer must be this token's issuer (the delegation chain is unbroken), this token's expiry must not exceed its parent's, and this token's scope must narrow its parent's (same kind; equal-or-descendant path when the parent carries one) with an identical capability verb (the capability-verb grammar has no sub-verb relation, so a different verb is a different authority, not a narrower one). Undecodable payload bytes return "malformed" and undecodable parent bytes return "parent_invalid" -- hostile input produces a verdict, never a throw.
-*/
-async function verifyCapabilityToken(token, options) {
-	const verdict = await verifyTokenChain(token, {
-		identity: options.identity,
-		clock: options.clock,
-		revocation: options.revocation
-	});
-	if (!verdict.ok) return verdict;
-	if (options.expectedBearer !== void 0 && !bytesEqual(verdict.claims.bearer, options.expectedBearer)) return {
-		ok: false,
-		reason: "bearer_mismatch"
-	};
-	return verdict;
-}
-async function verifyTokenChain(token, options) {
-	const [protectedHeader, , payload, signature] = token;
-	if (payload === null) return {
-		ok: false,
-		reason: "malformed"
-	};
-	let decodedClaims;
-	try {
-		decodedClaims = decode(payload, cdeDecodeOptions);
-	} catch {
-		return {
-			ok: false,
-			reason: "malformed"
-		};
-	}
-	const claimsResult = tokenClaimsSchema.safeParse(decodedClaims);
-	if (!claimsResult.success) return {
-		ok: false,
-		reason: "malformed"
-	};
-	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
-		ok: false,
-		reason: "bad_signature"
-	};
-	if (!bytesEqual(await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]), claims.issuer)) return {
-		ok: false,
-		reason: "wrong_issuer"
-	};
-	const now = options.clock.now();
-	if (claims.expires <= now) return {
-		ok: false,
-		reason: "expired"
-	};
-	if (claims["not-before"] !== void 0 && claims["not-before"] > now) return {
-		ok: false,
-		reason: "not_yet_valid"
-	};
-	const validUntil = claims["valid-until"];
-	if (validUntil !== void 0 && validUntil <= now) return {
-		ok: false,
-		reason: "content_expired"
-	};
-	if (await options.revocation.isRevoked(claims["token-id"], claims.issuer)) return {
-		ok: false,
-		reason: "revoked"
-	};
-	if (claims.parent !== void 0) {
-		let decodedParent;
-		try {
-			decodedParent = decode(claims.parent, cdeDecodeOptions);
-		} catch {
-			return {
-				ok: false,
-				reason: "parent_invalid"
-			};
-		}
-		const parentResult = capabilityTokenSchema.safeParse(decodedParent);
-		if (!parentResult.success) return {
-			ok: false,
-			reason: "parent_invalid"
-		};
-		const parentVerdict = await verifyTokenChain(parentResult.data, options);
-		if (!parentVerdict.ok) return {
-			ok: false,
-			reason: "parent_invalid"
-		};
-		if (!bytesEqual(parentVerdict.claims.bearer, claims.issuer)) return {
-			ok: false,
-			reason: "delegation_exceeds_parent"
-		};
-		if (claims.expires > parentVerdict.claims.expires) return {
-			ok: false,
-			reason: "delegation_exceeds_parent"
-		};
-		if (!scopeNarrows(parentVerdict.claims.scope, claims.scope)) return {
-			ok: false,
-			reason: "delegation_exceeds_parent"
-		};
-		if (parentVerdict.claims.capability !== claims.capability) return {
-			ok: false,
-			reason: "delegation_exceeds_parent"
-		};
-		const parentRemaining = parentVerdict.claims["delegations-remaining"];
-		if (parentRemaining !== void 0 && (claims["delegations-remaining"] === void 0 || claims["delegations-remaining"] >= parentRemaining)) return {
-			ok: false,
-			reason: "delegation_exceeds_parent"
-		};
-		return {
-			ok: true,
-			claims,
-			rootIssuer: parentVerdict.rootIssuer,
-			depth: parentVerdict.depth + 1
-		};
-	}
-	return {
-		ok: true,
-		claims,
-		rootIssuer: claims.issuer,
-		depth: 0
-	};
-}
-/**
-* Verifies one gossiped revocation-entry (management.cddl): a well-formed COSE_Sign1 whose signature verifies against its own embedded issuer-key, where that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id). A verifier that ingests a revocation-announce frame runs each entry through this before recording it in its revocation view; entries failing here are dropped, not stored. The issuer-match against a specific token's own issuer (only a token's own issuer may revoke it) is deliberately NOT checked here -- it happens at lookup time in RevocationCheck, against whichever token is being verified.
-*/
-async function verifyRevocationEntry(entry, options) {
-	const [protectedHeader, , payload, signature] = entry;
-	if (payload === null) return {
-		ok: false,
-		reason: "malformed"
-	};
-	let decodedClaims;
-	try {
-		decodedClaims = decode(payload, cdeDecodeOptions);
-	} catch {
-		return {
-			ok: false,
-			reason: "malformed"
-		};
-	}
-	const claimsResult = revocationClaimsSchema.safeParse(decodedClaims);
-	if (!claimsResult.success) return {
-		ok: false,
-		reason: "malformed"
-	};
-	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
-		ok: false,
-		reason: "bad_signature"
-	};
-	if (!bytesEqual(await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]), claims.issuer)) return {
-		ok: false,
-		reason: "wrong_issuer"
-	};
-	return {
-		ok: true,
-		claims
-	};
-}
-/** The narrowing arithmetic tokens.cddl's own delegation obligations require (bearer match, expiry within the parent's, scope narrows, same capability, delegations-remaining strictly less than the parent's) -- shared between mintCapabilityToken (which additionally builds and signs the resulting token) and canGrant (a pure query with no minting side effect at all), so the two can never silently drift into two different ideas of what "narrows" means. Returns the specific refusal reason, or undefined when every rule is satisfied. */
-function checkNarrowing(parentClaims, granterDeviceId, candidate) {
-	if (!bytesEqual(parentClaims.bearer, granterDeviceId)) return "parent_bearer_mismatch";
-	if (candidate.expires > parentClaims.expires) return "expires_exceeds_parent";
-	if (!scopeNarrows(parentClaims.scope, candidate.scope)) return "scope_does_not_narrow";
-	if (parentClaims.capability !== candidate.capability) return "capability_mismatch";
-	const parentRemaining = parentClaims["delegations-remaining"];
-	if (parentRemaining !== void 0 && (candidate.delegationsRemaining === void 0 || candidate.delegationsRemaining >= parentRemaining)) return "delegation_exceeds_parent";
-}
-/**
-* A pure query: could deviceId, presenting heldToken as its own delegation authority, successfully mint a delegation matching candidate right now -- without attempting (and potentially failing) a real mint just to find out. Reuses mintCapabilityToken's own narrowing arithmetic via checkNarrowing, so the two can never silently drift into different ideas of what "narrows" means.
-*
-* Deliberately narrower than a full mint attempt in one respect: this checks only the narrowing rules tokens.cddl's own delegation obligations require (bearer match, expiry, scope, capability, delegations-remaining), the same scope mintCapabilityToken itself checks a *parent* against -- it does not verify heldToken's own signature or revocation status, exactly as mintCapabilityToken never re-verifies its own parent's signature either. A caller that also needs heldToken's cryptographic validity confirmed calls verifyCapabilityToken separately.
-*/
-function canGrant(heldToken, deviceId, candidate, now) {
-	if (candidate.expires <= now) return false;
-	const heldClaims = decodeTokenClaims(heldToken);
-	if (heldClaims === void 0) return false;
-	return checkNarrowing(heldClaims, deviceId, candidate) === void 0;
-}
-/**
-* Mints one capability token: builds token-claims from the given fields, signs it as a COSE_Sign1 under `identity`'s own key, with a protected header matching what the frozen conformance vectors actually encode (`{1: alg, 4: issuer device-id}`, not the empty header a token merely needs to verify against itself).
-*
-* When `parent` is given, every one of `tokens.cddl`'s own narrowing obligations is enforced here, at issuance, rather than left for the far end to discover minutes or hours later as a bare `delegation_exceeds_parent` from `verifyCapabilityToken` -- the same "fail loudly, fail early" reasoning that governs every other boundary in this codebase. An issuer minting an invalid delegation is a bug in the caller; this function refuses rather than producing a token indistinguishable from a valid one until someone else verifies it.
-*/
-async function mintCapabilityToken(options) {
-	if (options.expires <= options.clock.now()) return {
-		ok: false,
-		reason: "already_expired"
-	};
-	let parentBytes;
-	if (options.parent !== void 0) {
-		const parentClaims = decodeTokenClaims(options.parent);
-		if (parentClaims === void 0) return {
-			ok: false,
-			reason: "parent_malformed"
-		};
-		const refusal = checkNarrowing(parentClaims, options.identity.deviceId, {
-			capability: options.capability,
-			scope: options.scope,
-			expires: options.expires,
-			...options.delegationsRemaining !== void 0 ? { delegationsRemaining: options.delegationsRemaining } : {}
-		});
-		if (refusal !== void 0) return {
-			ok: false,
-			reason: refusal
-		};
-		parentBytes = encodeBuf(options.parent);
-	}
-	const payload = encodeBuf({
-		"token-id": options.tokenId,
-		issuer: options.identity.deviceId,
-		"issuer-key": options.identity.identityKey,
-		bearer: options.bearer,
-		capability: options.capability,
-		scope: options.scope,
-		expires: options.expires,
-		...options.notBefore !== void 0 ? { "not-before": options.notBefore } : {},
-		...parentBytes !== void 0 ? { parent: parentBytes } : {},
-		...options.delegationsRemaining !== void 0 ? { "delegations-remaining": options.delegationsRemaining } : {}
-	});
-	const protectedHeader = protectedHeaderFor(options.identity);
-	return {
-		ok: true,
-		token: [
-			protectedHeader,
-			{},
-			payload,
-			await options.identity.sign(sig1ToBeSigned(protectedHeader, payload))
-		]
-	};
-}
-/** Mints one revocation-entry (management.cddl): a COSE_Sign1 over revocation-claims, signed the same way mintCapabilityToken signs a token. No narrowing chain to check -- a revocation entry has no parent and cannot fail to be issuable the way a delegated token can, so this returns the entry directly rather than a verdict. */
-async function mintRevocationEntry(options) {
-	const payload = encodeBuf({
-		"token-id": options.tokenId,
-		issuer: options.identity.deviceId,
-		"issuer-key": options.identity.identityKey,
-		"revoked-at": options.revokedAt
-	});
-	const protectedHeader = protectedHeaderFor(options.identity);
-	return [
-		protectedHeader,
-		{},
-		payload,
-		await options.identity.sign(sig1ToBeSigned(protectedHeader, payload))
-	];
-}
-//#endregion
-export { canGrant, mintCapabilityToken, mintRevocationEntry, scopeNarrows, verifyCapabilityToken, verifyRevocationEntry };
+import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-D9I1Pn14.mjs";
+export { canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/generated/protocol.cjs

@@ -312,7 +312,8 @@ const tokenClaimsSchema = zod.z.lazy(() => zod.z.object({
 	"not-before": zod.z.number().int().nonnegative().optional(),
 	"parent": zod.z.instanceof(Uint8Array).optional(),
 	"delegations-remaining": zod.z.number().int().nonnegative().optional(),
-	"valid-until": zod.z.number().int().nonnegative().optional()
+	"valid-until": zod.z.number().int().nonnegative().optional(),
+	"conditions": zod.z.instanceof(Uint8Array).optional()
 }).catchall(zod.z.unknown()));
 const pingFrameSchema = zod.z.lazy(() => zod.z.object({ "type": zod.z.literal("ping") }));
 const closeFrameSchema = zod.z.lazy(() => zod.z.object({

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-Dhswk7YD.cjs";
+import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-B3U828E7.cjs";
 export { CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.d.mts

@@ -1,2 +1,2 @@
-import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-Dhswk7YD.mjs";
+import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-B3U828E7.mjs";
 export { CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.mjs

@@ -311,7 +311,8 @@ const tokenClaimsSchema = z.lazy(() => z.object({
 	"not-before": z.number().int().nonnegative().optional(),
 	"parent": z.instanceof(Uint8Array).optional(),
 	"delegations-remaining": z.number().int().nonnegative().optional(),
-	"valid-until": z.number().int().nonnegative().optional()
+	"valid-until": z.number().int().nonnegative().optional(),
+	"conditions": z.instanceof(Uint8Array).optional()
 }).catchall(z.unknown()));
 const pingFrameSchema = z.lazy(() => z.object({ "type": z.literal("ping") }));
 const closeFrameSchema = z.lazy(() => z.object({

package/dist/{identity-B1hBV3YA.d.mts → identity-B7YMBhMf.d.mts}

@@ -1,4 +1,4 @@
-import { P as IdentityKey, x as DeviceId } from "./protocol-Dhswk7YD.mjs";
+import { P as IdentityKey, x as DeviceId } from "./protocol-B3U828E7.mjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/{identity-BldV8xFj.d.cts → identity-COdFfaW8.d.cts}

@@ -1,4 +1,4 @@
-import { P as IdentityKey, x as DeviceId } from "./protocol-Dhswk7YD.cjs";
+import { P as IdentityKey, x as DeviceId } from "./protocol-B3U828E7.cjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-BldV8xFj.cjs";
+import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
 export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-B1hBV3YA.mjs";
+import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
 export { IdentityPort };

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-hEUxrdhT.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-BrAqN6I5.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-BNNdUBq-.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-B_diuPHT.mjs";
 export { Connection, Listener, Transport };

package/dist/{protocol-Dhswk7YD.d.cts → protocol-B3U828E7.d.cts}

@@ -1001,6 +1001,7 @@ declare const tokenClaimsSchema: z.ZodLazy<z.ZodObject<{
   parent: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   "delegations-remaining": z.ZodOptional<z.ZodNumber>;
   "valid-until": z.ZodOptional<z.ZodNumber>;
+  conditions: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
 declare const pingFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"ping">;

package/dist/{protocol-Dhswk7YD.d.mts → protocol-B3U828E7.d.mts}

@@ -1001,6 +1001,7 @@ declare const tokenClaimsSchema: z.ZodLazy<z.ZodObject<{
   parent: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   "delegations-remaining": z.ZodOptional<z.ZodNumber>;
   "valid-until": z.ZodOptional<z.ZodNumber>;
+  conditions: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
 declare const pingFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"ping">;