wire-mesh-core 1.23.0 → 1.25.0

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { D as Frame } from "../protocol-l9RMR3s5.mjs";
-import { t as Connection } from "../transport-DWbvUc3L.mjs";
+import { N as Frame } from "../protocol-sW8d6Og-.mjs";
+import { t as Connection } from "../transport-B5E896PN.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { dt as RevocationEntry } from "../protocol-l9RMR3s5.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-H_mV_JCC.cjs";
+import { _t as RevocationEntry } from "../protocol-sW8d6Og-.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DfVfE00W.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { dt as RevocationEntry } from "../protocol-l9RMR3s5.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CBI54oF-.mjs";
+import { _t as RevocationEntry } from "../protocol-sW8d6Og-.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CpLDI5Fo.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
-import { a as verifyRevocationEntry } from "../tokens-VicRWTj1.mjs";
 import { bytesToHex } from "./device-id.mjs";
+import { a as verifyRevocationEntry } from "../tokens-VicRWTj1.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room-token-verification.d.cts

@@ -1,5 +1,5 @@
-import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-H_mV_JCC.cjs";
+import { D as DeviceId, Ft as TokenClaims, p as CapabilityToken } from "../protocol-sW8d6Og-.cjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-DfVfE00W.cjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/domain/room-token-verification.d.mts

@@ -1,5 +1,5 @@
-import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-CBI54oF-.mjs";
+import { D as DeviceId, Ft as TokenClaims, p as CapabilityToken } from "../protocol-sW8d6Og-.mjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-CpLDI5Fo.mjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
-import { i as verifyCapabilityToken } from "../tokens-VicRWTj1.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
+import { i as verifyCapabilityToken } from "../tokens-VicRWTj1.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room.cjs

@@ -0,0 +1,108 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+const require_domain_room_token_verification = require("./room-token-verification.cjs");
+let cbor2 = require("cbor2");
+//#region src/domain/room.ts
+/**
+* Room-notice verification (spec/room.cddl's own noticeboard extension of core/room). A room-notice is self-certifying the same way a capability-token or revocation-entry already is: a bare cose-sign1 whose payload carries its own signer's key, so a reader verifies posting authority from the entry alone, with no prior contact with the poster and no central gatekeeper. This module is the first TypeScript verifier for it -- no `room.ts` domain module existed anywhere before this, despite the CDDL claim (including `valid-until`) having shipped already.
+*/
+/**
+* RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD -- identical in shape to tokens.ts's own private helper of the same name, but reimplemented here rather than imported, since tokens.ts does not export it. Worth consolidating into a shared cose.ts once a third caller needs the identical helper, but two independent five-line copies is not yet a real duplication problem on its own.
+*/
+function sig1ToBeSigned(protectedHeader, payload) {
+	return (0, cbor2.encode)([
+		"Signature1",
+		protectedHeader,
+		/* @__PURE__ */ new Uint8Array(0),
+		payload
+	], cbor2.cdeEncodeOptions);
+}
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+	return true;
+}
+/** Lexicographic (bytewise-ascending) ordering -- the same convention room.cddl's own DM room-path already uses for its sorted pair. Shorter-but-equal-prefix sorts first, matching how Uint8Array.prototype comparisons behave nowhere natively, so this exists at all. */
+function compareBytes(a, b) {
+	const length = Math.min(a.length, b.length);
+	for (let i = 0; i < length; i += 1) {
+		const byteA = a[i];
+		const byteB = b[i];
+		if (byteA === void 0 || byteB === void 0) throw new Error("compareBytes: index out of range");
+		if (byteA !== byteB) return byteA - byteB;
+	}
+	return a.length - b.length;
+}
+/**
+* Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.
+*
+* Cross-author ordering (obligation 4) is deliberately NOT checked here -- it is a property of how a reader merges several posters' notices into one sequence, not a pass/fail condition on any single notice. Use compareRoomNotices for that once notices are already individually verified.
+*
+* Revocation (obligation 5) needs no separate step of its own: verifying the embedded token below already walks the full delegation chain against `options.revocation` as part of ordinary capability-token verification, and obligation 5 explicitly disclaims any retroactive "was the poster revoked as of posted-at" check -- only the token's own present-tense validity matters, which the embedded-token verification already establishes.
+*/
+async function verifyRoomNotice(notice, options) {
+	const [protectedHeader, , payload, signature] = notice;
+	if (payload === null) return {
+		ok: false,
+		reason: "malformed"
+	};
+	let decoded;
+	try {
+		decoded = (0, cbor2.decode)(payload, cbor2.cdeDecodeOptions);
+	} catch {
+		return {
+			ok: false,
+			reason: "malformed"
+		};
+	}
+	const parsed = require_generated_protocol.roomNoticeClaimsSchema.safeParse(decoded);
+	if (!parsed.success) return {
+		ok: false,
+		reason: "malformed"
+	};
+	const claims = parsed.data;
+	if (options.expectedRoom !== void 0 && claims.room !== options.expectedRoom) return {
+		ok: false,
+		reason: "wrong_room"
+	};
+	if (!await options.identity.verify(claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+		ok: false,
+		reason: "bad_signature"
+	};
+	if (!bytesEqual(await options.identity.deriveDeviceId(claims["poster-key"]["public-key"]), claims.poster)) return {
+		ok: false,
+		reason: "wrong_poster"
+	};
+	const validUntil = claims["valid-until"];
+	if (validUntil !== void 0 && validUntil <= options.clock.now()) return {
+		ok: false,
+		reason: "content_expired"
+	};
+	const tokenVerdict = await require_domain_room_token_verification.verifyRoomToken(claims.token, {
+		identity: options.identity,
+		clock: options.clock,
+		revocation: options.revocation,
+		expectedBearer: claims.poster,
+		roomPath: claims.room
+	});
+	if (!tokenVerdict.ok) return {
+		ok: false,
+		reason: tokenVerdict.reason
+	};
+	return {
+		ok: true,
+		claims
+	};
+}
+/**
+* Deterministic display ordering for room-notice entries from possibly several different posters (spec/room.cddl obligation 4): sorts by (posted-at, poster, notice-id), the exact tiebreak idiom the CDDL comment specifies -- the same "lowest wins" idea coordinator-frame's own lowest-device-id rule already uses for equal-term claims elsewhere in this spec. Takes already-verified claims (the output of verifyRoomNotice) -- this is purely a merge-order comparator, never a validity check, so it is kept structurally separate from verifyRoomNotice's own pass/fail verdict.
+*/
+function compareRoomNotices(a, b) {
+	if (a["posted-at"] !== b["posted-at"]) return a["posted-at"] - b["posted-at"];
+	const posterOrder = compareBytes(a.poster, b.poster);
+	if (posterOrder !== 0) return posterOrder;
+	return compareBytes(a["notice-id"], b["notice-id"]);
+}
+//#endregion
+exports.compareRoomNotices = compareRoomNotices;
+exports.verifyRoomNotice = verifyRoomNotice;

package/dist/domain/room.d.cts

@@ -0,0 +1,36 @@
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice } from "../protocol-sW8d6Og-.cjs";
+import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { a as RevocationCheck } from "../tokens-DfVfE00W.cjs";
+import { RoomTokenVerdictReason } from "./room-token-verification.cjs";
+//#region src/domain/room.d.ts
+export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | RoomTokenVerdictReason;
+export type RoomNoticeVerdict = {
+  ok: true;
+  claims: RoomNoticeClaims;
+} | {
+  ok: false;
+  reason: RoomNoticeVerdictReason;
+};
+export interface VerifyRoomNoticeOptions {
+  identity: IdentityPort;
+  clock: Clock;
+  revocation: RevocationCheck;
+  /**
+   * When given, refuses any notice not claiming exactly this room -- "is this the room I actually asked to read", checked against the notice's own self-declared `room` field before any cryptographic work, so a caller scanning a mixed stream of notices can cheaply skip ones for other rooms. Independent of, and layered on top of, this function's own unconditional internal self-consistency check (the embedded token's scope.path MUST equal the notice's own `room` field regardless of whether expectedRoom is given at all) -- a notice can be internally self-consistent yet still be for a room other than the one a caller expected, and this is the option that catches that case. Mirrors verifyCapabilityToken's own optional expectedBearer for the same "also assert it matches what I expected" shape.
+   */
+  expectedRoom?: RoomPath;
+}
+/**
+ * Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.
+ *
+ * Cross-author ordering (obligation 4) is deliberately NOT checked here -- it is a property of how a reader merges several posters' notices into one sequence, not a pass/fail condition on any single notice. Use compareRoomNotices for that once notices are already individually verified.
+ *
+ * Revocation (obligation 5) needs no separate step of its own: verifying the embedded token below already walks the full delegation chain against `options.revocation` as part of ordinary capability-token verification, and obligation 5 explicitly disclaims any retroactive "was the poster revoked as of posted-at" check -- only the token's own present-tense validity matters, which the embedded-token verification already establishes.
+ */
+export declare function verifyRoomNotice(notice: RoomNotice, options: Readonly<VerifyRoomNoticeOptions>): Promise<RoomNoticeVerdict>;
+/**
+ * Deterministic display ordering for room-notice entries from possibly several different posters (spec/room.cddl obligation 4): sorts by (posted-at, poster, notice-id), the exact tiebreak idiom the CDDL comment specifies -- the same "lowest wins" idea coordinator-frame's own lowest-device-id rule already uses for equal-term claims elsewhere in this spec. Takes already-verified claims (the output of verifyRoomNotice) -- this is purely a merge-order comparator, never a validity check, so it is kept structurally separate from verifyRoomNotice's own pass/fail verdict.
+ */
+export declare function compareRoomNotices(a: Readonly<RoomNoticeClaims>, b: Readonly<RoomNoticeClaims>): number;
+//#endregion

package/dist/domain/room.d.mts

@@ -0,0 +1,36 @@
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice } from "../protocol-sW8d6Og-.mjs";
+import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { a as RevocationCheck } from "../tokens-CpLDI5Fo.mjs";
+import { RoomTokenVerdictReason } from "./room-token-verification.mjs";
+//#region src/domain/room.d.ts
+export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | RoomTokenVerdictReason;
+export type RoomNoticeVerdict = {
+  ok: true;
+  claims: RoomNoticeClaims;
+} | {
+  ok: false;
+  reason: RoomNoticeVerdictReason;
+};
+export interface VerifyRoomNoticeOptions {
+  identity: IdentityPort;
+  clock: Clock;
+  revocation: RevocationCheck;
+  /**
+   * When given, refuses any notice not claiming exactly this room -- "is this the room I actually asked to read", checked against the notice's own self-declared `room` field before any cryptographic work, so a caller scanning a mixed stream of notices can cheaply skip ones for other rooms. Independent of, and layered on top of, this function's own unconditional internal self-consistency check (the embedded token's scope.path MUST equal the notice's own `room` field regardless of whether expectedRoom is given at all) -- a notice can be internally self-consistent yet still be for a room other than the one a caller expected, and this is the option that catches that case. Mirrors verifyCapabilityToken's own optional expectedBearer for the same "also assert it matches what I expected" shape.
+   */
+  expectedRoom?: RoomPath;
+}
+/**
+ * Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.
+ *
+ * Cross-author ordering (obligation 4) is deliberately NOT checked here -- it is a property of how a reader merges several posters' notices into one sequence, not a pass/fail condition on any single notice. Use compareRoomNotices for that once notices are already individually verified.
+ *
+ * Revocation (obligation 5) needs no separate step of its own: verifying the embedded token below already walks the full delegation chain against `options.revocation` as part of ordinary capability-token verification, and obligation 5 explicitly disclaims any retroactive "was the poster revoked as of posted-at" check -- only the token's own present-tense validity matters, which the embedded-token verification already establishes.
+ */
+export declare function verifyRoomNotice(notice: RoomNotice, options: Readonly<VerifyRoomNoticeOptions>): Promise<RoomNoticeVerdict>;
+/**
+ * Deterministic display ordering for room-notice entries from possibly several different posters (spec/room.cddl obligation 4): sorts by (posted-at, poster, notice-id), the exact tiebreak idiom the CDDL comment specifies -- the same "lowest wins" idea coordinator-frame's own lowest-device-id rule already uses for equal-term claims elsewhere in this spec. Takes already-verified claims (the output of verifyRoomNotice) -- this is purely a merge-order comparator, never a validity check, so it is kept structurally separate from verifyRoomNotice's own pass/fail verdict.
+ */
+export declare function compareRoomNotices(a: Readonly<RoomNoticeClaims>, b: Readonly<RoomNoticeClaims>): number;
+//#endregion

package/dist/domain/room.mjs

@@ -0,0 +1,106 @@
+import { roomNoticeClaimsSchema } from "../generated/protocol.mjs";
+import { verifyRoomToken } from "./room-token-verification.mjs";
+import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
+//#region src/domain/room.ts
+/**
+* Room-notice verification (spec/room.cddl's own noticeboard extension of core/room). A room-notice is self-certifying the same way a capability-token or revocation-entry already is: a bare cose-sign1 whose payload carries its own signer's key, so a reader verifies posting authority from the entry alone, with no prior contact with the poster and no central gatekeeper. This module is the first TypeScript verifier for it -- no `room.ts` domain module existed anywhere before this, despite the CDDL claim (including `valid-until`) having shipped already.
+*/
+/**
+* RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD -- identical in shape to tokens.ts's own private helper of the same name, but reimplemented here rather than imported, since tokens.ts does not export it. Worth consolidating into a shared cose.ts once a third caller needs the identical helper, but two independent five-line copies is not yet a real duplication problem on its own.
+*/
+function sig1ToBeSigned(protectedHeader, payload) {
+	return encode([
+		"Signature1",
+		protectedHeader,
+		/* @__PURE__ */ new Uint8Array(0),
+		payload
+	], cdeEncodeOptions);
+}
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+	return true;
+}
+/** Lexicographic (bytewise-ascending) ordering -- the same convention room.cddl's own DM room-path already uses for its sorted pair. Shorter-but-equal-prefix sorts first, matching how Uint8Array.prototype comparisons behave nowhere natively, so this exists at all. */
+function compareBytes(a, b) {
+	const length = Math.min(a.length, b.length);
+	for (let i = 0; i < length; i += 1) {
+		const byteA = a[i];
+		const byteB = b[i];
+		if (byteA === void 0 || byteB === void 0) throw new Error("compareBytes: index out of range");
+		if (byteA !== byteB) return byteA - byteB;
+	}
+	return a.length - b.length;
+}
+/**
+* Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.
+*
+* Cross-author ordering (obligation 4) is deliberately NOT checked here -- it is a property of how a reader merges several posters' notices into one sequence, not a pass/fail condition on any single notice. Use compareRoomNotices for that once notices are already individually verified.
+*
+* Revocation (obligation 5) needs no separate step of its own: verifying the embedded token below already walks the full delegation chain against `options.revocation` as part of ordinary capability-token verification, and obligation 5 explicitly disclaims any retroactive "was the poster revoked as of posted-at" check -- only the token's own present-tense validity matters, which the embedded-token verification already establishes.
+*/
+async function verifyRoomNotice(notice, options) {
+	const [protectedHeader, , payload, signature] = notice;
+	if (payload === null) return {
+		ok: false,
+		reason: "malformed"
+	};
+	let decoded;
+	try {
+		decoded = decode(payload, cdeDecodeOptions);
+	} catch {
+		return {
+			ok: false,
+			reason: "malformed"
+		};
+	}
+	const parsed = roomNoticeClaimsSchema.safeParse(decoded);
+	if (!parsed.success) return {
+		ok: false,
+		reason: "malformed"
+	};
+	const claims = parsed.data;
+	if (options.expectedRoom !== void 0 && claims.room !== options.expectedRoom) return {
+		ok: false,
+		reason: "wrong_room"
+	};
+	if (!await options.identity.verify(claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+		ok: false,
+		reason: "bad_signature"
+	};
+	if (!bytesEqual(await options.identity.deriveDeviceId(claims["poster-key"]["public-key"]), claims.poster)) return {
+		ok: false,
+		reason: "wrong_poster"
+	};
+	const validUntil = claims["valid-until"];
+	if (validUntil !== void 0 && validUntil <= options.clock.now()) return {
+		ok: false,
+		reason: "content_expired"
+	};
+	const tokenVerdict = await verifyRoomToken(claims.token, {
+		identity: options.identity,
+		clock: options.clock,
+		revocation: options.revocation,
+		expectedBearer: claims.poster,
+		roomPath: claims.room
+	});
+	if (!tokenVerdict.ok) return {
+		ok: false,
+		reason: tokenVerdict.reason
+	};
+	return {
+		ok: true,
+		claims
+	};
+}
+/**
+* Deterministic display ordering for room-notice entries from possibly several different posters (spec/room.cddl obligation 4): sorts by (posted-at, poster, notice-id), the exact tiebreak idiom the CDDL comment specifies -- the same "lowest wins" idea coordinator-frame's own lowest-device-id rule already uses for equal-term claims elsewhere in this spec. Takes already-verified claims (the output of verifyRoomNotice) -- this is purely a merge-order comparator, never a validity check, so it is kept structurally separate from verifyRoomNotice's own pass/fail verdict.
+*/
+function compareRoomNotices(a, b) {
+	if (a["posted-at"] !== b["posted-at"]) return a["posted-at"] - b["posted-at"];
+	const posterOrder = compareBytes(a.poster, b.poster);
+	if (posterOrder !== 0) return posterOrder;
+	return compareBytes(a["notice-id"], b["notice-id"]);
+}
+//#endregion
+export { compareRoomNotices, verifyRoomNotice };

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-H_mV_JCC.cjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-DfVfE00W.cjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CBI54oF-.mjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CpLDI5Fo.mjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/generated/protocol.cjs

@@ -1,33 +1,29 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let zod = require("zod");
 //#region src/generated/protocol.ts
-const dataHaveFrameSchema = zod.z.lazy(() => zod.z.object({
-	"type": zod.z.literal("data-have"),
-	"peer": zod.z.lazy(() => deviceIdSchema),
-	"head-seq": zod.z.number().int().nonnegative()
-}));
-const dataRequestFrameSchema = zod.z.lazy(() => zod.z.object({
-	"type": zod.z.literal("data-request"),
-	"peer": zod.z.lazy(() => deviceIdSchema),
-	"from-seq": zod.z.number().int().nonnegative()
-}));
-const dataEntriesFrameSchema = zod.z.lazy(() => zod.z.object({
-	"type": zod.z.literal("data-entries"),
-	"peer": zod.z.lazy(() => deviceIdSchema),
-	"from-seq": zod.z.number().int().nonnegative(),
-	"entries": zod.z.array(zod.z.instanceof(Uint8Array))
-}));
-const handleClaimsSchema = zod.z.lazy(() => zod.z.object({
-	"handle": zod.z.string(),
-	"device-id": zod.z.lazy(() => deviceIdSchema),
-	"identity-key": zod.z.lazy(() => identityKeySchema),
-	"candidates": zod.z.array(zod.z.lazy(() => wireCandidateSchema)).optional(),
-	"mailboxes": zod.z.array(zod.z.lazy(() => deviceIdSchema)).optional(),
-	"issued": zod.z.number().int().nonnegative(),
-	"expires": zod.z.number().int().nonnegative()
-}));
-const handleRecordSchema = zod.z.lazy(() => zod.z.lazy(() => coseSign1Schema));
+const transferIdSchema = zod.z.lazy(() => zod.z.instanceof(Uint8Array).refine((v) => v.length === 16, { message: "expected exactly 16 bytes" }));
+const bulkOpenSchema = zod.z.lazy(() => zod.z.object({
+	"verb": zod.z.literal("bulk.open"),
+	"transfer-id": zod.z.lazy(() => transferIdSchema),
+	"total-size": zod.z.number().int().nonnegative().optional(),
+	"content-type": zod.z.string().optional()
+}).catchall(zod.z.unknown()));
+const bulkResumeSchema = zod.z.lazy(() => zod.z.object({
+	"verb": zod.z.literal("bulk.resume"),
+	"transfer-id": zod.z.lazy(() => transferIdSchema),
+	"ack-seq": zod.z.number().int().nonnegative()
+}).catchall(zod.z.unknown()));
+const bulkCancelSchema = zod.z.lazy(() => zod.z.object({
+	"verb": zod.z.literal("bulk.cancel"),
+	"transfer-id": zod.z.lazy(() => transferIdSchema),
+	"reason": zod.z.string().optional()
+}).catchall(zod.z.unknown()));
 const manageCommandParamsSchema = zod.z.lazy(() => zod.z.union([
+	zod.z.union([
+		zod.z.lazy(() => bulkOpenSchema),
+		zod.z.lazy(() => bulkResumeSchema),
+		zod.z.lazy(() => bulkCancelSchema)
+	]),
 	zod.z.union([
 		zod.z.lazy(() => ptySpawnSchema),
 		zod.z.lazy(() => ptyWriteSchema),
@@ -54,6 +50,49 @@ const manageCommandParamsSchema = zod.z.lazy(() => zod.z.union([
 		zod.z.lazy(() => webrtcIceCandidateSchema)
 	])
 ]));
+const bulkDataFrameSchema = zod.z.lazy(() => zod.z.object({
+	"type": zod.z.literal("bulk-data"),
+	"transfer-id": zod.z.lazy(() => transferIdSchema),
+	"seq": zod.z.number().int().nonnegative(),
+	"bytes": zod.z.instanceof(Uint8Array)
+}));
+const bulkAckFrameSchema = zod.z.lazy(() => zod.z.object({
+	"type": zod.z.literal("bulk-ack"),
+	"transfer-id": zod.z.lazy(() => transferIdSchema),
+	"ack-seq": zod.z.number().int().nonnegative(),
+	"window": zod.z.number().int().nonnegative()
+}));
+const bulkEndFrameSchema = zod.z.lazy(() => zod.z.object({
+	"type": zod.z.literal("bulk-end"),
+	"transfer-id": zod.z.lazy(() => transferIdSchema),
+	"digest": zod.z.instanceof(Uint8Array)
+}));
+const dataHaveFrameSchema = zod.z.lazy(() => zod.z.object({
+	"type": zod.z.literal("data-have"),
+	"peer": zod.z.lazy(() => deviceIdSchema),
+	"head-seq": zod.z.number().int().nonnegative()
+}));
+const dataRequestFrameSchema = zod.z.lazy(() => zod.z.object({
+	"type": zod.z.literal("data-request"),
+	"peer": zod.z.lazy(() => deviceIdSchema),
+	"from-seq": zod.z.number().int().nonnegative()
+}));
+const dataEntriesFrameSchema = zod.z.lazy(() => zod.z.object({
+	"type": zod.z.literal("data-entries"),
+	"peer": zod.z.lazy(() => deviceIdSchema),
+	"from-seq": zod.z.number().int().nonnegative(),
+	"entries": zod.z.array(zod.z.instanceof(Uint8Array))
+}));
+const handleClaimsSchema = zod.z.lazy(() => zod.z.object({
+	"handle": zod.z.string(),
+	"device-id": zod.z.lazy(() => deviceIdSchema),
+	"identity-key": zod.z.lazy(() => identityKeySchema),
+	"candidates": zod.z.array(zod.z.lazy(() => wireCandidateSchema)).optional(),
+	"mailboxes": zod.z.array(zod.z.lazy(() => deviceIdSchema)).optional(),
+	"issued": zod.z.number().int().nonnegative(),
+	"expires": zod.z.number().int().nonnegative()
+}));
+const handleRecordSchema = zod.z.lazy(() => zod.z.lazy(() => coseSign1Schema));
 const ptySpawnSchema = zod.z.lazy(() => zod.z.object({
 	"verb": zod.z.literal("pty.spawn"),
 	"shell": zod.z.string().optional(),
@@ -122,7 +161,10 @@ const frameVariantSchema = zod.z.lazy(() => zod.z.union([
 	zod.z.lazy(() => streamEndFrameSchema),
 	zod.z.lazy(() => dataHaveFrameSchema),
 	zod.z.lazy(() => dataRequestFrameSchema),
-	zod.z.lazy(() => dataEntriesFrameSchema)
+	zod.z.lazy(() => dataEntriesFrameSchema),
+	zod.z.lazy(() => bulkDataFrameSchema),
+	zod.z.lazy(() => bulkAckFrameSchema),
+	zod.z.lazy(() => bulkEndFrameSchema)
 ]));
 const frameSchema = zod.z.lazy(() => zod.z.lazy(() => frameVariantSchema));
 const protocolVersionSchema = zod.z.lazy(() => zod.z.number().int().nonnegative());
@@ -137,7 +179,8 @@ const coreDomainNameSchema = zod.z.lazy(() => zod.z.union([
 	zod.z.literal("core/data"),
 	zod.z.literal("core/federation"),
 	zod.z.literal("core/webrtc"),
-	zod.z.literal("core/room")
+	zod.z.literal("core/room"),
+	zod.z.literal("core/bulk")
 ]));
 const namespacedDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+")));
 const privateUseDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+")));
@@ -399,6 +442,12 @@ const iceCandidateInitSchema = zod.z.lazy(() => zod.z.object({
 	"username-fragment": zod.z.string().optional()
 }));
 //#endregion
+exports.bulkAckFrameSchema = bulkAckFrameSchema;
+exports.bulkCancelSchema = bulkCancelSchema;
+exports.bulkDataFrameSchema = bulkDataFrameSchema;
+exports.bulkEndFrameSchema = bulkEndFrameSchema;
+exports.bulkOpenSchema = bulkOpenSchema;
+exports.bulkResumeSchema = bulkResumeSchema;
 exports.candidateKindSchema = candidateKindSchema;
 exports.candidatesFrameSchema = candidatesFrameSchema;
 exports.capabilityGrantOkSchema = capabilityGrantOkSchema;
@@ -482,6 +531,7 @@ exports.streamEndFrameSchema = streamEndFrameSchema;
 exports.streamSessionSchema = streamSessionSchema;
 exports.syncPunchFrameSchema = syncPunchFrameSchema;
 exports.tokenClaimsSchema = tokenClaimsSchema;
+exports.transferIdSchema = transferIdSchema;
 exports.webrtcAnswerSchema = webrtcAnswerSchema;
 exports.webrtcIceCandidateSchema = webrtcIceCandidateSchema;
 exports.webrtcOfferSchema = webrtcOfferSchema;

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-l9RMR3s5.cjs";
-export { CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };
+import { $ as PeerIdentity, $n as relayInboundFrameSchema, $t as capabilityTokenSchema, A as DomainId, An as manageOkSchema, At as StreamAckFrame, B as IdentityKey, Bn as pingFrameSchema, Bt as WireCandidate, C as CoseTokenHeaders, Cn as handleRecordSchema, Cr as webrtcAnswerSchema, Ct as RoomMembers, D as DeviceId, Dn as manageCommandParamsSchema, Dt as RoomPath, E as DataRequestFrame, En as identityKeySchema, Er as wireCandidateSchema, Et as RoomNoticeClaims, F as GossipFrame, Fn as namespacedDomainIdSchema, Ft as TokenClaims, G as ManageRequestFrame, Gn as procSpawnSchema, Gt as bulkOpenSchema, H as ManageCommandParams, Hn as privateUseDomainIdSchema, Ht as bulkCancelSchema, I as HandleClaims, In as observedAddressFrameSchema, It as TransferId, J as NamespacedCapability, Jn as ptyResizeSchema, Jt as candidatesFrameSchema, K as ManageResponseFrame, Kn as protocolVersionSchema, Kt as bulkResumeSchema, L as HandleRecord, Ln as ownerNamedRoomPathSchema, Lt as WebrtcAnswer, M as ExecSessionInfo, Mn as manageResponseFrameSchema, Mt as StreamEndFrame, N as Frame, Nn as messageRefSchema, Nt as StreamSession, O as DeviceIdHex, On as manageCommandSchema, Ot as RoomRead, P as FrameVariant, Pn as namespacedCapabilitySchema, Pt as SyncPunchFrame, Q as PeerAdvert, Qn as relayDataFrameSchema, Qt as capabilityScopeSchema, R as HandshakeFrame, Rn as peerAdvertSchema, Rt as WebrtcIceCandidate, S as CoseSign1, Sn as handleClaimsSchema, Sr as transferIdSchema, St as RoomMember, T as DataHaveFrame, Tn as iceCandidateInitSchema, Tr as webrtcOfferSchema, Tt as RoomNotice, U as ManageError, Un as procKillSchema, Ut as bulkDataFrameSchema, V as ManageCommand, Vn as privateUseCapabilitySchema, Vt as bulkAckFrameSchema, W as ManageOk, Wn as procSignalSchema, Wt as bulkEndFrameSchema, X as ObservedAddressFrame, Xn as ptyWriteSchema, Xt as capabilityGrantSchema, Y as NamespacedDomainId, Yn as ptySpawnSchema, Yt as capabilityGrantOkSchema, Z as OwnerNamedRoomPath, Zn as relayConnectFrameSchema, Zt as capabilityRequestSchema, _ as CoreCapability, _n as execListSchema, _r as streamDataFrameSchema, _t as RevocationEntry, a as BulkOpen, an as coseHeaderAlgSchema, ar as roomJoinOkSchema, at as ProcSpawn, b as CoseHeaderKid, bn as frameVariantSchema, br as syncPunchFrameSchema, bt as RoomJoinOk, c as CandidatesFrame, cn as coseSign1Schema, cr as roomMemberSchema, ct as PtyResize, d as CapabilityRequest, dn as dataHaveFrameSchema, dr as roomNoticeClaimsSchema, dt as RelayConnectFrame, en as capabilityVerbSchema, er as relayOfferFrameSchema, et as PingFrame, f as CapabilityScope, fn as dataRequestFrameSchema, fr as roomNoticeSchema, ft as RelayDataFrame, g as CoordinatorFrame, gn as domainIdSchema, gr as streamAckFrameSchema, gt as RevocationClaims, h as CloseFrame, hn as dmRoomPathSchema, hr as roomSendSchema, ht as RevocationAnnounceFrame, i as BulkEndFrame, in as coreDomainNameSchema, ir as roomInviteSchema, it as ProcSignal, j as ExecList, jn as manageRequestFrameSchema, jt as StreamDataFrame, k as DmRoomPath, kn as manageErrorSchema, kt as RoomSend, l as CapabilityGrant, ln as coseTokenHeadersSchema, lr as roomMembersOkSchema, lt as PtySpawn, m as CapabilityVerb, mn as deviceIdSchema, mr as roomReadSchema, mt as RelayOfferFrame, n as BulkCancel, nn as coordinatorFrameSchema, nr as revocationClaimsSchema, nt as PrivateUseDomainId, o as BulkResume, on as coseHeaderKidSchema, or as roomJoinSchema, ot as ProtocolVersion, p as CapabilityToken, pn as deviceIdHexSchema, pr as roomPathSchema, pt as RelayInboundFrame, q as MessageRef, qn as ptyKillSchema, qt as candidateKindSchema, r as BulkDataFrame, rn as coreCapabilitySchema, rr as revocationEntrySchema, rt as ProcKill, s as CandidateKind, sn as coseHeaderLabelSchema, sr as roomLeaveSchema, st as PtyKill, t as BulkAckFrame, tn as closeFrameSchema, tr as revocationAnnounceFrameSchema, tt as PrivateUseCapability, u as CapabilityGrantOk, un as dataEntriesFrameSchema, ur as roomMembersSchema, ut as PtyWrite, v as CoreDomainName, vn as execSessionInfoSchema, vr as streamEndFrameSchema, vt as RoomInvite, w as DataEntriesFrame, wn as handshakeFrameSchema, wr as webrtcIceCandidateSchema, wt as RoomMembersOk, x as CoseHeaderLabel, xn as gossipFrameSchema, xr as tokenClaimsSchema, xt as RoomLeave, y as CoseHeaderAlg, yn as frameSchema, yr as streamSessionSchema, yt as RoomJoin, z as IceCandidateInit, zn as peerIdentitySchema, zt as WebrtcOffer } from "../protocol-sW8d6Og-.cjs";
+export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, TransferId, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, transferIdSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };