wire-mesh-core 1.31.0 → 1.33.0

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as DeviceId, N as Frame, Q as PeerAdvert, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken } from "../protocol-sW8d6Og-.mjs";
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { D as DeviceId, N as Frame, Q as PeerAdvert, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-B5E896PN.mjs";
+import { r as Transport, t as Connection } from "../transport-Dy4h2eNY.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-sW8d6Og-.cjs";
-import { t as Connection } from "../transport-DxZ4JWZc.cjs";
+import { N as Frame } from "../protocol-gbXtNeOc.cjs";
+import { t as Connection } from "../transport-DAsFqDDS.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-sW8d6Og-.mjs";
-import { t as Connection } from "../transport-B5E896PN.mjs";
+import { N as Frame } from "../protocol-gbXtNeOc.mjs";
+import { t as Connection } from "../transport-Dy4h2eNY.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-sW8d6Og-.cjs";
-import { t as Connection } from "../transport-DxZ4JWZc.cjs";
+import { N as Frame } from "../protocol-gbXtNeOc.cjs";
+import { t as Connection } from "../transport-DAsFqDDS.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-sW8d6Og-.mjs";
-import { t as Connection } from "../transport-B5E896PN.mjs";
+import { N as Frame } from "../protocol-gbXtNeOc.mjs";
+import { t as Connection } from "../transport-Dy4h2eNY.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { _t as RevocationEntry } from "../protocol-sW8d6Og-.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DfVfE00W.cjs";
+import { _t as RevocationEntry } from "../protocol-gbXtNeOc.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-C9Kwy0Gk.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { _t as RevocationEntry } from "../protocol-sW8d6Og-.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CpLDI5Fo.mjs";
+import { _t as RevocationEntry } from "../protocol-gbXtNeOc.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-k172l0Iy.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
 import { bytesToHex } from "./device-id.mjs";
-import { a as verifyRevocationEntry } from "../tokens-VicRWTj1.mjs";
+import { a as verifyRevocationEntry } from "../tokens-CdQwzCyJ.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-rekey.cjs

@@ -0,0 +1,112 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+const require_domain_group_key = require("./group-key.cjs");
+const require_domain_room_token_verification = require("./room-token-verification.cjs");
+//#region src/domain/room-rekey.ts
+/**
+* room.rekey (wire-mesh#141, spec/room.cddl): distributes and rotates a room's symmetric content-encryption key. Two responsibilities, split the same way capability-grant.ts and capability-request.ts already split theirs: sendRoomRekey is the pushing side (a thin wrapper over MeshSession.sendManageRequest), and createRoomRekeyHandler is the receiving side.
+*
+* The receiving side's own security property is worth stating plainly, since it's what makes this handler simpler than it might look: it needs no separate check of who actually sent the request. verifyRoomToken (obligation 1) already certifies that the recipient's OWN held room:member token's delegation chain terminates at the room's real, rightful owner -- deriving the ECDH shared secret against that certified owner's own rootIssuerKey means a wrapped-key only ever unwraps correctly when it was actually produced by someone holding the real owner's private key. A forged room.rekey from anyone else -- an attacker, a not-yet-admitted stranger, even another legitimate member with no admission authority -- cannot produce ciphertext that unwraps, so it fails closed on the cryptography itself rather than needing a redundant, separately-maintained live-sender identity check.
+*/
+/**
+* Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+*/
+function buildRoomRekeyCommand(keyEpoch, wrappedKey) {
+	return {
+		verb: require_domain_room_token_verification.ROOM_MEMBER_CAPABILITY,
+		params: {
+			verb: "room.rekey",
+			"key-epoch": keyEpoch,
+			"wrapped-key": wrappedKey
+		}
+	};
+}
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+async function sendRoomRekey(session, roomPath, keyEpoch, wrappedKey, targetDevice, token) {
+	return session.sendManageRequest(buildRoomRekeyCommand(keyEpoch, wrappedKey), {
+		kind: "room",
+		path: roomPath
+	}, targetDevice, token);
+}
+/**
+* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+*/
+function createRoomRekeyHandler(options) {
+	return async function handleRoomRekey(incoming) {
+		if (incoming.command.verb !== "room:member") {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		const parsed = require_generated_protocol.roomRekeySchema.safeParse(incoming.command.params);
+		if (!parsed.success) {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		if (incoming.scope.kind !== "room" || incoming.scope.path === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "scope_mismatch"
+			});
+			return;
+		}
+		const roomPath = incoming.scope.path;
+		const verdict = await require_domain_room_token_verification.verifyRoomToken(options.ownRoomMemberToken, {
+			identity: options.identity,
+			clock: options.clock,
+			revocation: options.revocation,
+			expectedBearer: options.identity.deviceId,
+			roomPath
+		});
+		if (!verdict.ok) {
+			await incoming.respond({
+				result: "error",
+				code: verdict.reason
+			});
+			return;
+		}
+		const deriveSharedSecret = options.identity.deriveSharedSecret;
+		if (deriveSharedSecret === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "ecdh_unsupported"
+			});
+			return;
+		}
+		const keyEpoch = parsed.data["key-epoch"];
+		const wrappedKeys = Array.isArray(parsed.data["wrapped-key"]) ? parsed.data["wrapped-key"] : [parsed.data["wrapped-key"]];
+		const firstEpoch = keyEpoch - wrappedKeys.length + 1;
+		let contentKeys;
+		try {
+			const sharedSecret = await deriveSharedSecret(verdict.rootIssuerKey);
+			contentKeys = await Promise.all(wrappedKeys.map(async (wrapped, i) => {
+				const wrappingKey = await require_domain_group_key.deriveWrappingKey(sharedSecret, {
+					room: roomPath,
+					keyEpoch: firstEpoch + i
+				});
+				return require_domain_group_key.unwrapContentKey(wrappingKey, wrapped);
+			}));
+		} catch {
+			await incoming.respond({
+				result: "error",
+				code: "unwrap_failed"
+			});
+			return;
+		}
+		await incoming.respond({ result: "ok" });
+		options.onRekey({
+			room: roomPath,
+			keyEpoch,
+			contentKeys
+		});
+	};
+}
+//#endregion
+exports.buildRoomRekeyCommand = buildRoomRekeyCommand;
+exports.createRoomRekeyHandler = createRoomRekeyHandler;
+exports.sendRoomRekey = sendRoomRekey;

package/dist/domain/room-rekey.d.cts

@@ -0,0 +1,35 @@
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
+import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
+import { a as RevocationCheck } from "../tokens-C9Kwy0Gk.cjs";
+//#region src/domain/room-rekey.d.ts
+/**
+ * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+ */
+export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+/** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
+export interface RoomRekeyEvent {
+  room: string;
+  /** The highest epoch this room.rekey granted -- the same value the wire message itself carried. */
+  keyEpoch: number;
+  /** contentKeys[i] is the content-encryption key for epoch i+1, matching wrapped-key's own array-ordering convention (spec/room.cddl) -- always at least one entry (the current epoch), even under the default single-bstr, members-at-the-time policy. */
+  contentKeys: readonly Uint8Array[];
+}
+export interface CreateRoomRekeyHandlerOptions {
+  /** This recipient's own identity -- both the verification primitives ownRoomMemberToken is checked with, and (via deriveSharedSecret) the ECDH half of unwrapping. */
+  identity: IdentityPort;
+  clock: Clock;
+  revocation: RevocationCheck;
+  /** This recipient's own currently-held room:member token for the room being rekeyed, verified fresh on every incoming room.rekey (not cached) -- see this module's own doc comment for why its certified root issuer-key is what the ECDH derivation uses, rather than a separately-tracked live-sender identity. */
+  ownRoomMemberToken: CapabilityToken;
+  /** Called once per successfully unwrapped room.rekey. */
+  onRekey: (event: Readonly<RoomRekeyEvent>) => void;
+}
+/**
+ * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+ */
+export declare function createRoomRekeyHandler(options: Readonly<CreateRoomRekeyHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
+//#endregion

package/dist/domain/room-rekey.d.mts

@@ -0,0 +1,35 @@
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
+import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
+import { a as RevocationCheck } from "../tokens-k172l0Iy.mjs";
+//#region src/domain/room-rekey.d.ts
+/**
+ * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+ */
+export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+/** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
+export interface RoomRekeyEvent {
+  room: string;
+  /** The highest epoch this room.rekey granted -- the same value the wire message itself carried. */
+  keyEpoch: number;
+  /** contentKeys[i] is the content-encryption key for epoch i+1, matching wrapped-key's own array-ordering convention (spec/room.cddl) -- always at least one entry (the current epoch), even under the default single-bstr, members-at-the-time policy. */
+  contentKeys: readonly Uint8Array[];
+}
+export interface CreateRoomRekeyHandlerOptions {
+  /** This recipient's own identity -- both the verification primitives ownRoomMemberToken is checked with, and (via deriveSharedSecret) the ECDH half of unwrapping. */
+  identity: IdentityPort;
+  clock: Clock;
+  revocation: RevocationCheck;
+  /** This recipient's own currently-held room:member token for the room being rekeyed, verified fresh on every incoming room.rekey (not cached) -- see this module's own doc comment for why its certified root issuer-key is what the ECDH derivation uses, rather than a separately-tracked live-sender identity. */
+  ownRoomMemberToken: CapabilityToken;
+  /** Called once per successfully unwrapped room.rekey. */
+  onRekey: (event: Readonly<RoomRekeyEvent>) => void;
+}
+/**
+ * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+ */
+export declare function createRoomRekeyHandler(options: Readonly<CreateRoomRekeyHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
+//#endregion

package/dist/domain/room-rekey.mjs

@@ -0,0 +1,109 @@
+import { roomRekeySchema } from "../generated/protocol.mjs";
+import { deriveWrappingKey, unwrapContentKey } from "./group-key.mjs";
+import { ROOM_MEMBER_CAPABILITY, verifyRoomToken } from "./room-token-verification.mjs";
+//#region src/domain/room-rekey.ts
+/**
+* room.rekey (wire-mesh#141, spec/room.cddl): distributes and rotates a room's symmetric content-encryption key. Two responsibilities, split the same way capability-grant.ts and capability-request.ts already split theirs: sendRoomRekey is the pushing side (a thin wrapper over MeshSession.sendManageRequest), and createRoomRekeyHandler is the receiving side.
+*
+* The receiving side's own security property is worth stating plainly, since it's what makes this handler simpler than it might look: it needs no separate check of who actually sent the request. verifyRoomToken (obligation 1) already certifies that the recipient's OWN held room:member token's delegation chain terminates at the room's real, rightful owner -- deriving the ECDH shared secret against that certified owner's own rootIssuerKey means a wrapped-key only ever unwraps correctly when it was actually produced by someone holding the real owner's private key. A forged room.rekey from anyone else -- an attacker, a not-yet-admitted stranger, even another legitimate member with no admission authority -- cannot produce ciphertext that unwraps, so it fails closed on the cryptography itself rather than needing a redundant, separately-maintained live-sender identity check.
+*/
+/**
+* Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+*/
+function buildRoomRekeyCommand(keyEpoch, wrappedKey) {
+	return {
+		verb: ROOM_MEMBER_CAPABILITY,
+		params: {
+			verb: "room.rekey",
+			"key-epoch": keyEpoch,
+			"wrapped-key": wrappedKey
+		}
+	};
+}
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+async function sendRoomRekey(session, roomPath, keyEpoch, wrappedKey, targetDevice, token) {
+	return session.sendManageRequest(buildRoomRekeyCommand(keyEpoch, wrappedKey), {
+		kind: "room",
+		path: roomPath
+	}, targetDevice, token);
+}
+/**
+* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+*/
+function createRoomRekeyHandler(options) {
+	return async function handleRoomRekey(incoming) {
+		if (incoming.command.verb !== "room:member") {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		const parsed = roomRekeySchema.safeParse(incoming.command.params);
+		if (!parsed.success) {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		if (incoming.scope.kind !== "room" || incoming.scope.path === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "scope_mismatch"
+			});
+			return;
+		}
+		const roomPath = incoming.scope.path;
+		const verdict = await verifyRoomToken(options.ownRoomMemberToken, {
+			identity: options.identity,
+			clock: options.clock,
+			revocation: options.revocation,
+			expectedBearer: options.identity.deviceId,
+			roomPath
+		});
+		if (!verdict.ok) {
+			await incoming.respond({
+				result: "error",
+				code: verdict.reason
+			});
+			return;
+		}
+		const deriveSharedSecret = options.identity.deriveSharedSecret;
+		if (deriveSharedSecret === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "ecdh_unsupported"
+			});
+			return;
+		}
+		const keyEpoch = parsed.data["key-epoch"];
+		const wrappedKeys = Array.isArray(parsed.data["wrapped-key"]) ? parsed.data["wrapped-key"] : [parsed.data["wrapped-key"]];
+		const firstEpoch = keyEpoch - wrappedKeys.length + 1;
+		let contentKeys;
+		try {
+			const sharedSecret = await deriveSharedSecret(verdict.rootIssuerKey);
+			contentKeys = await Promise.all(wrappedKeys.map(async (wrapped, i) => {
+				const wrappingKey = await deriveWrappingKey(sharedSecret, {
+					room: roomPath,
+					keyEpoch: firstEpoch + i
+				});
+				return unwrapContentKey(wrappingKey, wrapped);
+			}));
+		} catch {
+			await incoming.respond({
+				result: "error",
+				code: "unwrap_failed"
+			});
+			return;
+		}
+		await incoming.respond({ result: "ok" });
+		options.onRekey({
+			room: roomPath,
+			keyEpoch,
+			contentKeys
+		});
+	};
+}
+//#endregion
+export { buildRoomRekeyCommand, createRoomRekeyHandler, sendRoomRekey };

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**
@@ -35,7 +35,8 @@ async function verifyRoomToken(token, options) {
 	};
 	return {
 		ok: true,
-		claims: verdict.claims
+		claims: verdict.claims,
+		rootIssuerKey: verdict.rootIssuerKey
 	};
 }
 //#endregion

package/dist/domain/room-token-verification.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, Ft as TokenClaims, p as CapabilityToken } from "../protocol-sW8d6Og-.cjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-DfVfE00W.cjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-C9Kwy0Gk.cjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";
@@ -7,6 +7,8 @@ export type RoomTokenVerdictReason = TokenVerdictReason | "wrong_scope_kind" | "
 export type RoomTokenVerdict = {
   ok: true;
   claims: TokenClaims;
+  /** The chain's own certified root issuer-key -- for a named room, this is exactly the room's rightful owner (obligation 1 just confirmed the chain terminates there), and for a DM it's the verifying identity's own key. Lets a caller (e.g. room.rekey's own handler) derive an ECDH shared secret against the room's real owner with no separate live-sender identity check needed. */
+  rootIssuerKey: IdentityKey;
 } | {
   ok: false;
   reason: RoomTokenVerdictReason;

package/dist/domain/room-token-verification.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, Ft as TokenClaims, p as CapabilityToken } from "../protocol-sW8d6Og-.mjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-CpLDI5Fo.mjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-k172l0Iy.mjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";
@@ -7,6 +7,8 @@ export type RoomTokenVerdictReason = TokenVerdictReason | "wrong_scope_kind" | "
 export type RoomTokenVerdict = {
   ok: true;
   claims: TokenClaims;
+  /** The chain's own certified root issuer-key -- for a named room, this is exactly the room's rightful owner (obligation 1 just confirmed the chain terminates there), and for a DM it's the verifying identity's own key. Lets a caller (e.g. room.rekey's own handler) derive an ECDH shared secret against the room's real owner with no separate live-sender identity check needed. */
+  rootIssuerKey: IdentityKey;
 } | {
   ok: false;
   reason: RoomTokenVerdictReason;

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
 import { deviceIdToHex } from "./device-id.mjs";
-import { i as verifyCapabilityToken } from "../tokens-VicRWTj1.mjs";
+import { i as verifyCapabilityToken } from "../tokens-CdQwzCyJ.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**
@@ -34,7 +34,8 @@ async function verifyRoomToken(token, options) {
 	};
 	return {
 		ok: true,
-		claims: verdict.claims
+		claims: verdict.claims,
+		rootIssuerKey: verdict.rootIssuerKey
 	};
 }
 //#endregion

package/dist/domain/room.d.cts

@@ -1,7 +1,7 @@
-import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-sW8d6Og-.cjs";
-import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-DfVfE00W.cjs";
+import { a as RevocationCheck } from "../tokens-C9Kwy0Gk.cjs";
 import { RoomTokenVerdictReason } from "./room-token-verification.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | RoomTokenVerdictReason;

package/dist/domain/room.d.mts

@@ -1,7 +1,7 @@
-import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-sW8d6Og-.mjs";
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-CpLDI5Fo.mjs";
+import { a as RevocationCheck } from "../tokens-k172l0Iy.mjs";
 import { RoomTokenVerdictReason } from "./room-token-verification.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | RoomTokenVerdictReason;

package/dist/domain/tokens.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 exports.canGrant = require_tokens.canGrant;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-DfVfE00W.cjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-C9Kwy0Gk.cjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CpLDI5Fo.mjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-k172l0Iy.mjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-VicRWTj1.mjs";
+import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-CdQwzCyJ.mjs";
 export { canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/generated/protocol.cjs

@@ -44,6 +44,7 @@ const manageCommandParamsSchema = zod.z.lazy(() => zod.z.union([
 		zod.z.lazy(() => roomMembersSchema)
 	]),
 	zod.z.union([zod.z.lazy(() => roomJoinSchema), zod.z.lazy(() => roomInviteSchema)]),
+	zod.z.lazy(() => roomRekeySchema),
 	zod.z.union([
 		zod.z.lazy(() => webrtcOfferSchema),
 		zod.z.lazy(() => webrtcAnswerSchema),
@@ -276,6 +277,11 @@ const roomInviteSchema = zod.z.lazy(() => zod.z.object({
 	"invitee": zod.z.lazy(() => deviceIdSchema),
 	"token": zod.z.lazy(() => capabilityTokenSchema)
 }).catchall(zod.z.unknown()));
+const roomRekeySchema = zod.z.lazy(() => zod.z.object({
+	"verb": zod.z.literal("room.rekey"),
+	"key-epoch": zod.z.number().int().nonnegative(),
+	"wrapped-key": zod.z.union([zod.z.instanceof(Uint8Array), zod.z.array(zod.z.instanceof(Uint8Array))])
+}).catchall(zod.z.unknown()));
 const roomMemberSchema = zod.z.lazy(() => zod.z.object({ "device": zod.z.lazy(() => deviceIdSchema) }).catchall(zod.z.unknown()));
 const roomJoinOkSchema = zod.z.lazy(() => zod.z.object({
 	"result": zod.z.literal("ok"),
@@ -297,7 +303,8 @@ const roomNoticeClaimsSchema = zod.z.lazy(() => zod.z.object({
 	"content-type": zod.z.string(),
 	"content": zod.z.instanceof(Uint8Array),
 	"refs": zod.z.array(zod.z.lazy(() => messageRefSchema)).optional(),
-	"valid-until": zod.z.number().int().nonnegative().optional()
+	"valid-until": zod.z.number().int().nonnegative().optional(),
+	"key-epoch": zod.z.number().int().nonnegative().optional()
 }).catchall(zod.z.unknown()));
 const streamSessionSchema = zod.z.lazy(() => zod.z.number().int().nonnegative());
 const streamDataFrameSchema = zod.z.lazy(() => zod.z.object({
@@ -524,6 +531,7 @@ exports.roomNoticeClaimsSchema = roomNoticeClaimsSchema;
 exports.roomNoticeSchema = roomNoticeSchema;
 exports.roomPathSchema = roomPathSchema;
 exports.roomReadSchema = roomReadSchema;
+exports.roomRekeySchema = roomRekeySchema;
 exports.roomSendSchema = roomSendSchema;
 exports.streamAckFrameSchema = streamAckFrameSchema;
 exports.streamDataFrameSchema = streamDataFrameSchema;

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as PeerIdentity, $n as relayInboundFrameSchema, $t as capabilityTokenSchema, A as DomainId, An as manageOkSchema, At as StreamAckFrame, B as IdentityKey, Bn as pingFrameSchema, Bt as WireCandidate, C as CoseTokenHeaders, Cn as handleRecordSchema, Cr as webrtcAnswerSchema, Ct as RoomMembers, D as DeviceId, Dn as manageCommandParamsSchema, Dt as RoomPath, E as DataRequestFrame, En as identityKeySchema, Er as wireCandidateSchema, Et as RoomNoticeClaims, F as GossipFrame, Fn as namespacedDomainIdSchema, Ft as TokenClaims, G as ManageRequestFrame, Gn as procSpawnSchema, Gt as bulkOpenSchema, H as ManageCommandParams, Hn as privateUseDomainIdSchema, Ht as bulkCancelSchema, I as HandleClaims, In as observedAddressFrameSchema, It as TransferId, J as NamespacedCapability, Jn as ptyResizeSchema, Jt as candidatesFrameSchema, K as ManageResponseFrame, Kn as protocolVersionSchema, Kt as bulkResumeSchema, L as HandleRecord, Ln as ownerNamedRoomPathSchema, Lt as WebrtcAnswer, M as ExecSessionInfo, Mn as manageResponseFrameSchema, Mt as StreamEndFrame, N as Frame, Nn as messageRefSchema, Nt as StreamSession, O as DeviceIdHex, On as manageCommandSchema, Ot as RoomRead, P as FrameVariant, Pn as namespacedCapabilitySchema, Pt as SyncPunchFrame, Q as PeerAdvert, Qn as relayDataFrameSchema, Qt as capabilityScopeSchema, R as HandshakeFrame, Rn as peerAdvertSchema, Rt as WebrtcIceCandidate, S as CoseSign1, Sn as handleClaimsSchema, Sr as transferIdSchema, St as RoomMember, T as DataHaveFrame, Tn as iceCandidateInitSchema, Tr as webrtcOfferSchema, Tt as RoomNotice, U as ManageError, Un as procKillSchema, Ut as bulkDataFrameSchema, V as ManageCommand, Vn as privateUseCapabilitySchema, Vt as bulkAckFrameSchema, W as ManageOk, Wn as procSignalSchema, Wt as bulkEndFrameSchema, X as ObservedAddressFrame, Xn as ptyWriteSchema, Xt as capabilityGrantSchema, Y as NamespacedDomainId, Yn as ptySpawnSchema, Yt as capabilityGrantOkSchema, Z as OwnerNamedRoomPath, Zn as relayConnectFrameSchema, Zt as capabilityRequestSchema, _ as CoreCapability, _n as execListSchema, _r as streamDataFrameSchema, _t as RevocationEntry, a as BulkOpen, an as coseHeaderAlgSchema, ar as roomJoinOkSchema, at as ProcSpawn, b as CoseHeaderKid, bn as frameVariantSchema, br as syncPunchFrameSchema, bt as RoomJoinOk, c as CandidatesFrame, cn as coseSign1Schema, cr as roomMemberSchema, ct as PtyResize, d as CapabilityRequest, dn as dataHaveFrameSchema, dr as roomNoticeClaimsSchema, dt as RelayConnectFrame, en as capabilityVerbSchema, er as relayOfferFrameSchema, et as PingFrame, f as CapabilityScope, fn as dataRequestFrameSchema, fr as roomNoticeSchema, ft as RelayDataFrame, g as CoordinatorFrame, gn as domainIdSchema, gr as streamAckFrameSchema, gt as RevocationClaims, h as CloseFrame, hn as dmRoomPathSchema, hr as roomSendSchema, ht as RevocationAnnounceFrame, i as BulkEndFrame, in as coreDomainNameSchema, ir as roomInviteSchema, it as ProcSignal, j as ExecList, jn as manageRequestFrameSchema, jt as StreamDataFrame, k as DmRoomPath, kn as manageErrorSchema, kt as RoomSend, l as CapabilityGrant, ln as coseTokenHeadersSchema, lr as roomMembersOkSchema, lt as PtySpawn, m as CapabilityVerb, mn as deviceIdSchema, mr as roomReadSchema, mt as RelayOfferFrame, n as BulkCancel, nn as coordinatorFrameSchema, nr as revocationClaimsSchema, nt as PrivateUseDomainId, o as BulkResume, on as coseHeaderKidSchema, or as roomJoinSchema, ot as ProtocolVersion, p as CapabilityToken, pn as deviceIdHexSchema, pr as roomPathSchema, pt as RelayInboundFrame, q as MessageRef, qn as ptyKillSchema, qt as candidateKindSchema, r as BulkDataFrame, rn as coreCapabilitySchema, rr as revocationEntrySchema, rt as ProcKill, s as CandidateKind, sn as coseHeaderLabelSchema, sr as roomLeaveSchema, st as PtyKill, t as BulkAckFrame, tn as closeFrameSchema, tr as revocationAnnounceFrameSchema, tt as PrivateUseCapability, u as CapabilityGrantOk, un as dataEntriesFrameSchema, ur as roomMembersSchema, ut as PtyWrite, v as CoreDomainName, vn as execSessionInfoSchema, vr as streamEndFrameSchema, vt as RoomInvite, w as DataEntriesFrame, wn as handshakeFrameSchema, wr as webrtcIceCandidateSchema, wt as RoomMembersOk, x as CoseHeaderLabel, xn as gossipFrameSchema, xr as tokenClaimsSchema, xt as RoomLeave, y as CoseHeaderAlg, yn as frameSchema, yr as streamSessionSchema, yt as RoomJoin, z as IceCandidateInit, zn as peerIdentitySchema, zt as WebrtcOffer } from "../protocol-sW8d6Og-.cjs";
-export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, TransferId, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, transferIdSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };
+import { $ as PeerIdentity, $n as relayDataFrameSchema, $t as capabilityScopeSchema, A as DomainId, An as manageErrorSchema, At as RoomSend, B as IdentityKey, Bn as peerIdentitySchema, Bt as WebrtcOffer, C as CoseTokenHeaders, Cn as handleClaimsSchema, Cr as tokenClaimsSchema, Ct as RoomMembers, D as DeviceId, Dn as identityKeySchema, Dr as webrtcOfferSchema, Dt as RoomPath, E as DataRequestFrame, En as iceCandidateInitSchema, Er as webrtcIceCandidateSchema, Et as RoomNoticeClaims, F as GossipFrame, Fn as namespacedCapabilitySchema, Ft as SyncPunchFrame, G as ManageRequestFrame, Gn as procSignalSchema, Gt as bulkEndFrameSchema, H as ManageCommandParams, Hn as privateUseCapabilitySchema, Ht as bulkAckFrameSchema, I as HandleClaims, In as namespacedDomainIdSchema, It as TokenClaims, J as NamespacedCapability, Jn as ptyKillSchema, Jt as candidateKindSchema, K as ManageResponseFrame, Kn as procSpawnSchema, Kt as bulkOpenSchema, L as HandleRecord, Ln as observedAddressFrameSchema, Lt as TransferId, M as ExecSessionInfo, Mn as manageRequestFrameSchema, Mt as StreamDataFrame, N as Frame, Nn as manageResponseFrameSchema, Nt as StreamEndFrame, O as DeviceIdHex, On as manageCommandParamsSchema, Or as wireCandidateSchema, Ot as RoomRead, P as FrameVariant, Pn as messageRefSchema, Pt as StreamSession, Q as PeerAdvert, Qn as relayConnectFrameSchema, Qt as capabilityRequestSchema, R as HandshakeFrame, Rn as ownerNamedRoomPathSchema, Rt as WebrtcAnswer, S as CoseSign1, Sn as gossipFrameSchema, Sr as syncPunchFrameSchema, St as RoomMember, T as DataHaveFrame, Tn as handshakeFrameSchema, Tr as webrtcAnswerSchema, Tt as RoomNotice, U as ManageError, Un as privateUseDomainIdSchema, Ut as bulkCancelSchema, V as ManageCommand, Vn as pingFrameSchema, Vt as WireCandidate, W as ManageOk, Wn as procKillSchema, Wt as bulkDataFrameSchema, X as ObservedAddressFrame, Xn as ptySpawnSchema, Xt as capabilityGrantOkSchema, Y as NamespacedDomainId, Yn as ptyResizeSchema, Yt as candidatesFrameSchema, Z as OwnerNamedRoomPath, Zn as ptyWriteSchema, Zt as capabilityGrantSchema, _ as CoreCapability, _n as domainIdSchema, _r as roomSendSchema, _t as RevocationEntry, a as BulkOpen, an as coreDomainNameSchema, ar as roomInviteSchema, at as ProcSpawn, b as CoseHeaderKid, bn as frameSchema, br as streamEndFrameSchema, bt as RoomJoinOk, c as CandidatesFrame, cn as coseHeaderLabelSchema, cr as roomLeaveSchema, ct as PtyResize, d as CapabilityRequest, dn as dataEntriesFrameSchema, dr as roomMembersSchema, dt as RelayConnectFrame, en as capabilityTokenSchema, er as relayInboundFrameSchema, et as PingFrame, f as CapabilityScope, fn as dataHaveFrameSchema, fr as roomNoticeClaimsSchema, ft as RelayDataFrame, g as CoordinatorFrame, gn as dmRoomPathSchema, gr as roomRekeySchema, gt as RevocationClaims, h as CloseFrame, hn as deviceIdSchema, hr as roomReadSchema, ht as RevocationAnnounceFrame, i as BulkEndFrame, in as coreCapabilitySchema, ir as revocationEntrySchema, it as ProcSignal, j as ExecList, jn as manageOkSchema, jt as StreamAckFrame, k as DmRoomPath, kn as manageCommandSchema, kt as RoomRekey, l as CapabilityGrant, ln as coseSign1Schema, lr as roomMemberSchema, lt as PtySpawn, m as CapabilityVerb, mn as deviceIdHexSchema, mr as roomPathSchema, mt as RelayOfferFrame, n as BulkCancel, nn as closeFrameSchema, nr as revocationAnnounceFrameSchema, nt as PrivateUseDomainId, o as BulkResume, on as coseHeaderAlgSchema, or as roomJoinOkSchema, ot as ProtocolVersion, p as CapabilityToken, pn as dataRequestFrameSchema, pr as roomNoticeSchema, pt as RelayInboundFrame, q as MessageRef, qn as protocolVersionSchema, qt as bulkResumeSchema, r as BulkDataFrame, rn as coordinatorFrameSchema, rr as revocationClaimsSchema, rt as ProcKill, s as CandidateKind, sn as coseHeaderKidSchema, sr as roomJoinSchema, st as PtyKill, t as BulkAckFrame, tn as capabilityVerbSchema, tr as relayOfferFrameSchema, tt as PrivateUseCapability, u as CapabilityGrantOk, un as coseTokenHeadersSchema, ur as roomMembersOkSchema, ut as PtyWrite, v as CoreDomainName, vn as execListSchema, vr as streamAckFrameSchema, vt as RoomInvite, w as DataEntriesFrame, wn as handleRecordSchema, wr as transferIdSchema, wt as RoomMembersOk, x as CoseHeaderLabel, xn as frameVariantSchema, xr as streamSessionSchema, xt as RoomLeave, y as CoseHeaderAlg, yn as execSessionInfoSchema, yr as streamDataFrameSchema, yt as RoomJoin, z as IceCandidateInit, zn as peerAdvertSchema, zt as WebrtcIceCandidate } from "../protocol-gbXtNeOc.cjs";
+export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, TransferId, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, transferIdSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };