wire-mesh-core 1.31.0 → 1.33.0

package/dist/generated/protocol.d.mts

@@ -1,2 +1,2 @@
-import { $ as PeerIdentity, $n as relayInboundFrameSchema, $t as capabilityTokenSchema, A as DomainId, An as manageOkSchema, At as StreamAckFrame, B as IdentityKey, Bn as pingFrameSchema, Bt as WireCandidate, C as CoseTokenHeaders, Cn as handleRecordSchema, Cr as webrtcAnswerSchema, Ct as RoomMembers, D as DeviceId, Dn as manageCommandParamsSchema, Dt as RoomPath, E as DataRequestFrame, En as identityKeySchema, Er as wireCandidateSchema, Et as RoomNoticeClaims, F as GossipFrame, Fn as namespacedDomainIdSchema, Ft as TokenClaims, G as ManageRequestFrame, Gn as procSpawnSchema, Gt as bulkOpenSchema, H as ManageCommandParams, Hn as privateUseDomainIdSchema, Ht as bulkCancelSchema, I as HandleClaims, In as observedAddressFrameSchema, It as TransferId, J as NamespacedCapability, Jn as ptyResizeSchema, Jt as candidatesFrameSchema, K as ManageResponseFrame, Kn as protocolVersionSchema, Kt as bulkResumeSchema, L as HandleRecord, Ln as ownerNamedRoomPathSchema, Lt as WebrtcAnswer, M as ExecSessionInfo, Mn as manageResponseFrameSchema, Mt as StreamEndFrame, N as Frame, Nn as messageRefSchema, Nt as StreamSession, O as DeviceIdHex, On as manageCommandSchema, Ot as RoomRead, P as FrameVariant, Pn as namespacedCapabilitySchema, Pt as SyncPunchFrame, Q as PeerAdvert, Qn as relayDataFrameSchema, Qt as capabilityScopeSchema, R as HandshakeFrame, Rn as peerAdvertSchema, Rt as WebrtcIceCandidate, S as CoseSign1, Sn as handleClaimsSchema, Sr as transferIdSchema, St as RoomMember, T as DataHaveFrame, Tn as iceCandidateInitSchema, Tr as webrtcOfferSchema, Tt as RoomNotice, U as ManageError, Un as procKillSchema, Ut as bulkDataFrameSchema, V as ManageCommand, Vn as privateUseCapabilitySchema, Vt as bulkAckFrameSchema, W as ManageOk, Wn as procSignalSchema, Wt as bulkEndFrameSchema, X as ObservedAddressFrame, Xn as ptyWriteSchema, Xt as capabilityGrantSchema, Y as NamespacedDomainId, Yn as ptySpawnSchema, Yt as capabilityGrantOkSchema, Z as OwnerNamedRoomPath, Zn as relayConnectFrameSchema, Zt as capabilityRequestSchema, _ as CoreCapability, _n as execListSchema, _r as streamDataFrameSchema, _t as RevocationEntry, a as BulkOpen, an as coseHeaderAlgSchema, ar as roomJoinOkSchema, at as ProcSpawn, b as CoseHeaderKid, bn as frameVariantSchema, br as syncPunchFrameSchema, bt as RoomJoinOk, c as CandidatesFrame, cn as coseSign1Schema, cr as roomMemberSchema, ct as PtyResize, d as CapabilityRequest, dn as dataHaveFrameSchema, dr as roomNoticeClaimsSchema, dt as RelayConnectFrame, en as capabilityVerbSchema, er as relayOfferFrameSchema, et as PingFrame, f as CapabilityScope, fn as dataRequestFrameSchema, fr as roomNoticeSchema, ft as RelayDataFrame, g as CoordinatorFrame, gn as domainIdSchema, gr as streamAckFrameSchema, gt as RevocationClaims, h as CloseFrame, hn as dmRoomPathSchema, hr as roomSendSchema, ht as RevocationAnnounceFrame, i as BulkEndFrame, in as coreDomainNameSchema, ir as roomInviteSchema, it as ProcSignal, j as ExecList, jn as manageRequestFrameSchema, jt as StreamDataFrame, k as DmRoomPath, kn as manageErrorSchema, kt as RoomSend, l as CapabilityGrant, ln as coseTokenHeadersSchema, lr as roomMembersOkSchema, lt as PtySpawn, m as CapabilityVerb, mn as deviceIdSchema, mr as roomReadSchema, mt as RelayOfferFrame, n as BulkCancel, nn as coordinatorFrameSchema, nr as revocationClaimsSchema, nt as PrivateUseDomainId, o as BulkResume, on as coseHeaderKidSchema, or as roomJoinSchema, ot as ProtocolVersion, p as CapabilityToken, pn as deviceIdHexSchema, pr as roomPathSchema, pt as RelayInboundFrame, q as MessageRef, qn as ptyKillSchema, qt as candidateKindSchema, r as BulkDataFrame, rn as coreCapabilitySchema, rr as revocationEntrySchema, rt as ProcKill, s as CandidateKind, sn as coseHeaderLabelSchema, sr as roomLeaveSchema, st as PtyKill, t as BulkAckFrame, tn as closeFrameSchema, tr as revocationAnnounceFrameSchema, tt as PrivateUseCapability, u as CapabilityGrantOk, un as dataEntriesFrameSchema, ur as roomMembersSchema, ut as PtyWrite, v as CoreDomainName, vn as execSessionInfoSchema, vr as streamEndFrameSchema, vt as RoomInvite, w as DataEntriesFrame, wn as handshakeFrameSchema, wr as webrtcIceCandidateSchema, wt as RoomMembersOk, x as CoseHeaderLabel, xn as gossipFrameSchema, xr as tokenClaimsSchema, xt as RoomLeave, y as CoseHeaderAlg, yn as frameSchema, yr as streamSessionSchema, yt as RoomJoin, z as IceCandidateInit, zn as peerIdentitySchema, zt as WebrtcOffer } from "../protocol-sW8d6Og-.mjs";
-export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, TransferId, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, transferIdSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };
+import { $ as PeerIdentity, $n as relayDataFrameSchema, $t as capabilityScopeSchema, A as DomainId, An as manageErrorSchema, At as RoomSend, B as IdentityKey, Bn as peerIdentitySchema, Bt as WebrtcOffer, C as CoseTokenHeaders, Cn as handleClaimsSchema, Cr as tokenClaimsSchema, Ct as RoomMembers, D as DeviceId, Dn as identityKeySchema, Dr as webrtcOfferSchema, Dt as RoomPath, E as DataRequestFrame, En as iceCandidateInitSchema, Er as webrtcIceCandidateSchema, Et as RoomNoticeClaims, F as GossipFrame, Fn as namespacedCapabilitySchema, Ft as SyncPunchFrame, G as ManageRequestFrame, Gn as procSignalSchema, Gt as bulkEndFrameSchema, H as ManageCommandParams, Hn as privateUseCapabilitySchema, Ht as bulkAckFrameSchema, I as HandleClaims, In as namespacedDomainIdSchema, It as TokenClaims, J as NamespacedCapability, Jn as ptyKillSchema, Jt as candidateKindSchema, K as ManageResponseFrame, Kn as procSpawnSchema, Kt as bulkOpenSchema, L as HandleRecord, Ln as observedAddressFrameSchema, Lt as TransferId, M as ExecSessionInfo, Mn as manageRequestFrameSchema, Mt as StreamDataFrame, N as Frame, Nn as manageResponseFrameSchema, Nt as StreamEndFrame, O as DeviceIdHex, On as manageCommandParamsSchema, Or as wireCandidateSchema, Ot as RoomRead, P as FrameVariant, Pn as messageRefSchema, Pt as StreamSession, Q as PeerAdvert, Qn as relayConnectFrameSchema, Qt as capabilityRequestSchema, R as HandshakeFrame, Rn as ownerNamedRoomPathSchema, Rt as WebrtcAnswer, S as CoseSign1, Sn as gossipFrameSchema, Sr as syncPunchFrameSchema, St as RoomMember, T as DataHaveFrame, Tn as handshakeFrameSchema, Tr as webrtcAnswerSchema, Tt as RoomNotice, U as ManageError, Un as privateUseDomainIdSchema, Ut as bulkCancelSchema, V as ManageCommand, Vn as pingFrameSchema, Vt as WireCandidate, W as ManageOk, Wn as procKillSchema, Wt as bulkDataFrameSchema, X as ObservedAddressFrame, Xn as ptySpawnSchema, Xt as capabilityGrantOkSchema, Y as NamespacedDomainId, Yn as ptyResizeSchema, Yt as candidatesFrameSchema, Z as OwnerNamedRoomPath, Zn as ptyWriteSchema, Zt as capabilityGrantSchema, _ as CoreCapability, _n as domainIdSchema, _r as roomSendSchema, _t as RevocationEntry, a as BulkOpen, an as coreDomainNameSchema, ar as roomInviteSchema, at as ProcSpawn, b as CoseHeaderKid, bn as frameSchema, br as streamEndFrameSchema, bt as RoomJoinOk, c as CandidatesFrame, cn as coseHeaderLabelSchema, cr as roomLeaveSchema, ct as PtyResize, d as CapabilityRequest, dn as dataEntriesFrameSchema, dr as roomMembersSchema, dt as RelayConnectFrame, en as capabilityTokenSchema, er as relayInboundFrameSchema, et as PingFrame, f as CapabilityScope, fn as dataHaveFrameSchema, fr as roomNoticeClaimsSchema, ft as RelayDataFrame, g as CoordinatorFrame, gn as dmRoomPathSchema, gr as roomRekeySchema, gt as RevocationClaims, h as CloseFrame, hn as deviceIdSchema, hr as roomReadSchema, ht as RevocationAnnounceFrame, i as BulkEndFrame, in as coreCapabilitySchema, ir as revocationEntrySchema, it as ProcSignal, j as ExecList, jn as manageOkSchema, jt as StreamAckFrame, k as DmRoomPath, kn as manageCommandSchema, kt as RoomRekey, l as CapabilityGrant, ln as coseSign1Schema, lr as roomMemberSchema, lt as PtySpawn, m as CapabilityVerb, mn as deviceIdHexSchema, mr as roomPathSchema, mt as RelayOfferFrame, n as BulkCancel, nn as closeFrameSchema, nr as revocationAnnounceFrameSchema, nt as PrivateUseDomainId, o as BulkResume, on as coseHeaderAlgSchema, or as roomJoinOkSchema, ot as ProtocolVersion, p as CapabilityToken, pn as dataRequestFrameSchema, pr as roomNoticeSchema, pt as RelayInboundFrame, q as MessageRef, qn as protocolVersionSchema, qt as bulkResumeSchema, r as BulkDataFrame, rn as coordinatorFrameSchema, rr as revocationClaimsSchema, rt as ProcKill, s as CandidateKind, sn as coseHeaderKidSchema, sr as roomJoinSchema, st as PtyKill, t as BulkAckFrame, tn as capabilityVerbSchema, tr as relayOfferFrameSchema, tt as PrivateUseCapability, u as CapabilityGrantOk, un as coseTokenHeadersSchema, ur as roomMembersOkSchema, ut as PtyWrite, v as CoreDomainName, vn as execListSchema, vr as streamAckFrameSchema, vt as RoomInvite, w as DataEntriesFrame, wn as handleRecordSchema, wr as transferIdSchema, wt as RoomMembersOk, x as CoseHeaderLabel, xn as frameVariantSchema, xr as streamSessionSchema, xt as RoomLeave, y as CoseHeaderAlg, yn as execSessionInfoSchema, yr as streamDataFrameSchema, yt as RoomJoin, z as IceCandidateInit, zn as peerAdvertSchema, zt as WebrtcIceCandidate } from "../protocol-gbXtNeOc.mjs";
+export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, TransferId, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, transferIdSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.mjs

@@ -43,6 +43,7 @@ const manageCommandParamsSchema = z.lazy(() => z.union([
 		z.lazy(() => roomMembersSchema)
 	]),
 	z.union([z.lazy(() => roomJoinSchema), z.lazy(() => roomInviteSchema)]),
+	z.lazy(() => roomRekeySchema),
 	z.union([
 		z.lazy(() => webrtcOfferSchema),
 		z.lazy(() => webrtcAnswerSchema),
@@ -275,6 +276,11 @@ const roomInviteSchema = z.lazy(() => z.object({
 	"invitee": z.lazy(() => deviceIdSchema),
 	"token": z.lazy(() => capabilityTokenSchema)
 }).catchall(z.unknown()));
+const roomRekeySchema = z.lazy(() => z.object({
+	"verb": z.literal("room.rekey"),
+	"key-epoch": z.number().int().nonnegative(),
+	"wrapped-key": z.union([z.instanceof(Uint8Array), z.array(z.instanceof(Uint8Array))])
+}).catchall(z.unknown()));
 const roomMemberSchema = z.lazy(() => z.object({ "device": z.lazy(() => deviceIdSchema) }).catchall(z.unknown()));
 const roomJoinOkSchema = z.lazy(() => z.object({
 	"result": z.literal("ok"),
@@ -296,7 +302,8 @@ const roomNoticeClaimsSchema = z.lazy(() => z.object({
 	"content-type": z.string(),
 	"content": z.instanceof(Uint8Array),
 	"refs": z.array(z.lazy(() => messageRefSchema)).optional(),
-	"valid-until": z.number().int().nonnegative().optional()
+	"valid-until": z.number().int().nonnegative().optional(),
+	"key-epoch": z.number().int().nonnegative().optional()
 }).catchall(z.unknown()));
 const streamSessionSchema = z.lazy(() => z.number().int().nonnegative());
 const streamDataFrameSchema = z.lazy(() => z.object({
@@ -441,4 +448,4 @@ const iceCandidateInitSchema = z.lazy(() => z.object({
 	"username-fragment": z.string().optional()
 }));
 //#endregion
-export { bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, transferIdSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };
+export { bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, transferIdSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/{identity-C5N86BPz.d.mts → identity-B4XBWkqg.d.cts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-sW8d6Og-.mjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-gbXtNeOc.cjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
@@ -12,6 +12,8 @@ interface IdentityPort {
   verify: (key: IdentityKey, message: Uint8Array, signature: Uint8Array) => Promise<boolean>;
   /** Derives the device-id an arbitrary public key would produce (SHA-256 of the raw public-key bytes -- never a certificate's own DER encoding, the bug both Cascade and agent-comms had to fix). Used to check a token's self-certifying issuer-key against its claimed issuer, not just the local node's own identity. */
   deriveDeviceId: (publicKey: Uint8Array) => Promise<DeviceId>;
+  /** Derives a raw ECDH shared secret against a peer's identity-key, the asymmetric half of room.rekey's own ECIES key-wrapping construction (wire-mesh#141) -- HKDF and AES-256-GCM, the symmetric half, need no port since they operate on plain bytes already in hand, with no platform-specific key custody involved. Optional, not a method every implementation must throw from: ECDH is only defined here for an ES256 (P-256) identity-key, so an Ed25519-only identity genuinely cannot support it, the same "some identities can do this, some can't" reality `sign`'s own two-algorithm dispatch already reflects. A caller that needs this and finds it absent must fail closed, never substitute a different construction. Returns the raw shared-secret bytes, NOT yet an encryption key -- always pass through HKDF first, never use ECDH output directly as a symmetric key. */
+  deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
 export { IdentityPort as t };

package/dist/{identity-DJ06jn4k.d.cts → identity-CIb9dGkJ.d.mts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-sW8d6Og-.cjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-gbXtNeOc.mjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
@@ -12,6 +12,8 @@ interface IdentityPort {
   verify: (key: IdentityKey, message: Uint8Array, signature: Uint8Array) => Promise<boolean>;
   /** Derives the device-id an arbitrary public key would produce (SHA-256 of the raw public-key bytes -- never a certificate's own DER encoding, the bug both Cascade and agent-comms had to fix). Used to check a token's self-certifying issuer-key against its claimed issuer, not just the local node's own identity. */
   deriveDeviceId: (publicKey: Uint8Array) => Promise<DeviceId>;
+  /** Derives a raw ECDH shared secret against a peer's identity-key, the asymmetric half of room.rekey's own ECIES key-wrapping construction (wire-mesh#141) -- HKDF and AES-256-GCM, the symmetric half, need no port since they operate on plain bytes already in hand, with no platform-specific key custody involved. Optional, not a method every implementation must throw from: ECDH is only defined here for an ES256 (P-256) identity-key, so an Ed25519-only identity genuinely cannot support it, the same "some identities can do this, some can't" reality `sign`'s own two-algorithm dispatch already reflects. A caller that needs this and finds it absent must fail closed, never substitute a different construction. Returns the raw shared-secret bytes, NOT yet an encryption key -- always pass through HKDF first, never use ECDH output directly as a symmetric key. */
+  deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
 export { IdentityPort as t };

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 export { IdentityPort };

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-DxZ4JWZc.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-DAsFqDDS.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-B5E896PN.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-Dy4h2eNY.mjs";
 export { Connection, Listener, Transport };

package/dist/{protocol-sW8d6Og-.d.cts → protocol-gbXtNeOc.d.cts}

@@ -102,7 +102,11 @@ declare const manageCommandParamsSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodUni
     "1": z.ZodOptional<z.ZodNumber>;
     "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-}, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+}, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+  verb: z.ZodLiteral<"room.rekey">;
+  "key-epoch": z.ZodNumber;
+  "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+}, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
   verb: z.ZodLiteral<"webrtc.offer">;
   "negotiation-id": z.ZodNumber;
   sdp: z.ZodString;
@@ -362,7 +366,11 @@ declare const frameVariantSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.Zod
         "1": z.ZodOptional<z.ZodNumber>;
         "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
       }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+      verb: z.ZodLiteral<"room.rekey">;
+      "key-epoch": z.ZodNumber;
+      "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+    }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
       verb: z.ZodLiteral<"webrtc.offer">;
       "negotiation-id": z.ZodNumber;
       sdp: z.ZodString;
@@ -589,7 +597,11 @@ declare const frameSchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.
         "1": z.ZodOptional<z.ZodNumber>;
         "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
       }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+      verb: z.ZodLiteral<"room.rekey">;
+      "key-epoch": z.ZodNumber;
+      "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+    }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
       verb: z.ZodLiteral<"webrtc.offer">;
       "negotiation-id": z.ZodNumber;
       sdp: z.ZodString;
@@ -787,7 +799,11 @@ declare const manageCommandSchema: z.ZodLazy<z.ZodObject<{
       "1": z.ZodOptional<z.ZodNumber>;
       "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
     }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-  }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+  }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    verb: z.ZodLiteral<"room.rekey">;
+    "key-epoch": z.ZodNumber;
+    "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+  }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
     verb: z.ZodLiteral<"webrtc.offer">;
     "negotiation-id": z.ZodNumber;
     sdp: z.ZodString;
@@ -896,7 +912,11 @@ declare const manageRequestFrameSchema: z.ZodLazy<z.ZodObject<{
         "1": z.ZodOptional<z.ZodNumber>;
         "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
       }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+      verb: z.ZodLiteral<"room.rekey">;
+      "key-epoch": z.ZodNumber;
+      "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+    }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
       verb: z.ZodLiteral<"webrtc.offer">;
       "negotiation-id": z.ZodNumber;
       sdp: z.ZodString;
@@ -1024,6 +1044,11 @@ declare const roomInviteSchema: z.ZodLazy<z.ZodObject<{
     "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
+declare const roomRekeySchema: z.ZodLazy<z.ZodObject<{
+  verb: z.ZodLiteral<"room.rekey">;
+  "key-epoch": z.ZodNumber;
+  "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+}, z.core.$catchall<z.ZodUnknown>>>;
 declare const roomMemberSchema: z.ZodLazy<z.ZodObject<{
   device: z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
@@ -1067,6 +1092,7 @@ declare const roomNoticeClaimsSchema: z.ZodLazy<z.ZodObject<{
     relation: z.ZodString;
   }, z.core.$strip>>>>>;
   "valid-until": z.ZodOptional<z.ZodNumber>;
+  "key-epoch": z.ZodOptional<z.ZodNumber>;
 }, z.core.$catchall<z.ZodUnknown>>>;
 declare const streamSessionSchema: z.ZodLazy<z.ZodNumber>;
 declare const streamDataFrameSchema: z.ZodLazy<z.ZodObject<{
@@ -1279,6 +1305,7 @@ type RoomMembers = z.infer<typeof roomMembersSchema>;
 type MessageRef = z.infer<typeof messageRefSchema>;
 type RoomJoin = z.infer<typeof roomJoinSchema>;
 type RoomInvite = z.infer<typeof roomInviteSchema>;
+type RoomRekey = z.infer<typeof roomRekeySchema>;
 type RoomMember = z.infer<typeof roomMemberSchema>;
 type RoomJoinOk = z.infer<typeof roomJoinOkSchema>;
 type RoomMembersOk = z.infer<typeof roomMembersOkSchema>;
@@ -1319,4 +1346,4 @@ type WebrtcAnswer = z.infer<typeof webrtcAnswerSchema>;
 type WebrtcIceCandidate = z.infer<typeof webrtcIceCandidateSchema>;
 type IceCandidateInit = z.infer<typeof iceCandidateInitSchema>;
 //#endregion
-export { PeerIdentity as $, relayInboundFrameSchema as $n, capabilityTokenSchema as $t, DomainId as A, manageOkSchema as An, StreamAckFrame as At, IdentityKey as B, pingFrameSchema as Bn, WireCandidate as Bt, CoseTokenHeaders as C, handleRecordSchema as Cn, webrtcAnswerSchema as Cr, RoomMembers as Ct, DeviceId as D, manageCommandParamsSchema as Dn, RoomPath as Dt, DataRequestFrame as E, identityKeySchema as En, wireCandidateSchema as Er, RoomNoticeClaims as Et, GossipFrame as F, namespacedDomainIdSchema as Fn, TokenClaims as Ft, ManageRequestFrame as G, procSpawnSchema as Gn, bulkOpenSchema as Gt, ManageCommandParams as H, privateUseDomainIdSchema as Hn, bulkCancelSchema as Ht, HandleClaims as I, observedAddressFrameSchema as In, TransferId as It, NamespacedCapability as J, ptyResizeSchema as Jn, candidatesFrameSchema as Jt, ManageResponseFrame as K, protocolVersionSchema as Kn, bulkResumeSchema as Kt, HandleRecord as L, ownerNamedRoomPathSchema as Ln, WebrtcAnswer as Lt, ExecSessionInfo as M, manageResponseFrameSchema as Mn, StreamEndFrame as Mt, Frame as N, messageRefSchema as Nn, StreamSession as Nt, DeviceIdHex as O, manageCommandSchema as On, RoomRead as Ot, FrameVariant as P, namespacedCapabilitySchema as Pn, SyncPunchFrame as Pt, PeerAdvert as Q, relayDataFrameSchema as Qn, capabilityScopeSchema as Qt, HandshakeFrame as R, peerAdvertSchema as Rn, WebrtcIceCandidate as Rt, CoseSign1 as S, handleClaimsSchema as Sn, transferIdSchema as Sr, RoomMember as St, DataHaveFrame as T, iceCandidateInitSchema as Tn, webrtcOfferSchema as Tr, RoomNotice as Tt, ManageError as U, procKillSchema as Un, bulkDataFrameSchema as Ut, ManageCommand as V, privateUseCapabilitySchema as Vn, bulkAckFrameSchema as Vt, ManageOk as W, procSignalSchema as Wn, bulkEndFrameSchema as Wt, ObservedAddressFrame as X, ptyWriteSchema as Xn, capabilityGrantSchema as Xt, NamespacedDomainId as Y, ptySpawnSchema as Yn, capabilityGrantOkSchema as Yt, OwnerNamedRoomPath as Z, relayConnectFrameSchema as Zn, capabilityRequestSchema as Zt, CoreCapability as _, execListSchema as _n, streamDataFrameSchema as _r, RevocationEntry as _t, BulkOpen as a, coseHeaderAlgSchema as an, roomJoinOkSchema as ar, ProcSpawn as at, CoseHeaderKid as b, frameVariantSchema as bn, syncPunchFrameSchema as br, RoomJoinOk as bt, CandidatesFrame as c, coseSign1Schema as cn, roomMemberSchema as cr, PtyResize as ct, CapabilityRequest as d, dataHaveFrameSchema as dn, roomNoticeClaimsSchema as dr, RelayConnectFrame as dt, capabilityVerbSchema as en, relayOfferFrameSchema as er, PingFrame as et, CapabilityScope as f, dataRequestFrameSchema as fn, roomNoticeSchema as fr, RelayDataFrame as ft, CoordinatorFrame as g, domainIdSchema as gn, streamAckFrameSchema as gr, RevocationClaims as gt, CloseFrame as h, dmRoomPathSchema as hn, roomSendSchema as hr, RevocationAnnounceFrame as ht, BulkEndFrame as i, coreDomainNameSchema as in, roomInviteSchema as ir, ProcSignal as it, ExecList as j, manageRequestFrameSchema as jn, StreamDataFrame as jt, DmRoomPath as k, manageErrorSchema as kn, RoomSend as kt, CapabilityGrant as l, coseTokenHeadersSchema as ln, roomMembersOkSchema as lr, PtySpawn as lt, CapabilityVerb as m, deviceIdSchema as mn, roomReadSchema as mr, RelayOfferFrame as mt, BulkCancel as n, coordinatorFrameSchema as nn, revocationClaimsSchema as nr, PrivateUseDomainId as nt, BulkResume as o, coseHeaderKidSchema as on, roomJoinSchema as or, ProtocolVersion as ot, CapabilityToken as p, deviceIdHexSchema as pn, roomPathSchema as pr, RelayInboundFrame as pt, MessageRef as q, ptyKillSchema as qn, candidateKindSchema as qt, BulkDataFrame as r, coreCapabilitySchema as rn, revocationEntrySchema as rr, ProcKill as rt, CandidateKind as s, coseHeaderLabelSchema as sn, roomLeaveSchema as sr, PtyKill as st, BulkAckFrame as t, closeFrameSchema as tn, revocationAnnounceFrameSchema as tr, PrivateUseCapability as tt, CapabilityGrantOk as u, dataEntriesFrameSchema as un, roomMembersSchema as ur, PtyWrite as ut, CoreDomainName as v, execSessionInfoSchema as vn, streamEndFrameSchema as vr, RoomInvite as vt, DataEntriesFrame as w, handshakeFrameSchema as wn, webrtcIceCandidateSchema as wr, RoomMembersOk as wt, CoseHeaderLabel as x, gossipFrameSchema as xn, tokenClaimsSchema as xr, RoomLeave as xt, CoseHeaderAlg as y, frameSchema as yn, streamSessionSchema as yr, RoomJoin as yt, IceCandidateInit as z, peerIdentitySchema as zn, WebrtcOffer as zt };
+export { PeerIdentity as $, relayDataFrameSchema as $n, capabilityScopeSchema as $t, DomainId as A, manageErrorSchema as An, RoomSend as At, IdentityKey as B, peerIdentitySchema as Bn, WebrtcOffer as Bt, CoseTokenHeaders as C, handleClaimsSchema as Cn, tokenClaimsSchema as Cr, RoomMembers as Ct, DeviceId as D, identityKeySchema as Dn, webrtcOfferSchema as Dr, RoomPath as Dt, DataRequestFrame as E, iceCandidateInitSchema as En, webrtcIceCandidateSchema as Er, RoomNoticeClaims as Et, GossipFrame as F, namespacedCapabilitySchema as Fn, SyncPunchFrame as Ft, ManageRequestFrame as G, procSignalSchema as Gn, bulkEndFrameSchema as Gt, ManageCommandParams as H, privateUseCapabilitySchema as Hn, bulkAckFrameSchema as Ht, HandleClaims as I, namespacedDomainIdSchema as In, TokenClaims as It, NamespacedCapability as J, ptyKillSchema as Jn, candidateKindSchema as Jt, ManageResponseFrame as K, procSpawnSchema as Kn, bulkOpenSchema as Kt, HandleRecord as L, observedAddressFrameSchema as Ln, TransferId as Lt, ExecSessionInfo as M, manageRequestFrameSchema as Mn, StreamDataFrame as Mt, Frame as N, manageResponseFrameSchema as Nn, StreamEndFrame as Nt, DeviceIdHex as O, manageCommandParamsSchema as On, wireCandidateSchema as Or, RoomRead as Ot, FrameVariant as P, messageRefSchema as Pn, StreamSession as Pt, PeerAdvert as Q, relayConnectFrameSchema as Qn, capabilityRequestSchema as Qt, HandshakeFrame as R, ownerNamedRoomPathSchema as Rn, WebrtcAnswer as Rt, CoseSign1 as S, gossipFrameSchema as Sn, syncPunchFrameSchema as Sr, RoomMember as St, DataHaveFrame as T, handshakeFrameSchema as Tn, webrtcAnswerSchema as Tr, RoomNotice as Tt, ManageError as U, privateUseDomainIdSchema as Un, bulkCancelSchema as Ut, ManageCommand as V, pingFrameSchema as Vn, WireCandidate as Vt, ManageOk as W, procKillSchema as Wn, bulkDataFrameSchema as Wt, ObservedAddressFrame as X, ptySpawnSchema as Xn, capabilityGrantOkSchema as Xt, NamespacedDomainId as Y, ptyResizeSchema as Yn, candidatesFrameSchema as Yt, OwnerNamedRoomPath as Z, ptyWriteSchema as Zn, capabilityGrantSchema as Zt, CoreCapability as _, domainIdSchema as _n, roomSendSchema as _r, RevocationEntry as _t, BulkOpen as a, coreDomainNameSchema as an, roomInviteSchema as ar, ProcSpawn as at, CoseHeaderKid as b, frameSchema as bn, streamEndFrameSchema as br, RoomJoinOk as bt, CandidatesFrame as c, coseHeaderLabelSchema as cn, roomLeaveSchema as cr, PtyResize as ct, CapabilityRequest as d, dataEntriesFrameSchema as dn, roomMembersSchema as dr, RelayConnectFrame as dt, capabilityTokenSchema as en, relayInboundFrameSchema as er, PingFrame as et, CapabilityScope as f, dataHaveFrameSchema as fn, roomNoticeClaimsSchema as fr, RelayDataFrame as ft, CoordinatorFrame as g, dmRoomPathSchema as gn, roomRekeySchema as gr, RevocationClaims as gt, CloseFrame as h, deviceIdSchema as hn, roomReadSchema as hr, RevocationAnnounceFrame as ht, BulkEndFrame as i, coreCapabilitySchema as in, revocationEntrySchema as ir, ProcSignal as it, ExecList as j, manageOkSchema as jn, StreamAckFrame as jt, DmRoomPath as k, manageCommandSchema as kn, RoomRekey as kt, CapabilityGrant as l, coseSign1Schema as ln, roomMemberSchema as lr, PtySpawn as lt, CapabilityVerb as m, deviceIdHexSchema as mn, roomPathSchema as mr, RelayOfferFrame as mt, BulkCancel as n, closeFrameSchema as nn, revocationAnnounceFrameSchema as nr, PrivateUseDomainId as nt, BulkResume as o, coseHeaderAlgSchema as on, roomJoinOkSchema as or, ProtocolVersion as ot, CapabilityToken as p, dataRequestFrameSchema as pn, roomNoticeSchema as pr, RelayInboundFrame as pt, MessageRef as q, protocolVersionSchema as qn, bulkResumeSchema as qt, BulkDataFrame as r, coordinatorFrameSchema as rn, revocationClaimsSchema as rr, ProcKill as rt, CandidateKind as s, coseHeaderKidSchema as sn, roomJoinSchema as sr, PtyKill as st, BulkAckFrame as t, capabilityVerbSchema as tn, relayOfferFrameSchema as tr, PrivateUseCapability as tt, CapabilityGrantOk as u, coseTokenHeadersSchema as un, roomMembersOkSchema as ur, PtyWrite as ut, CoreDomainName as v, execListSchema as vn, streamAckFrameSchema as vr, RoomInvite as vt, DataEntriesFrame as w, handleRecordSchema as wn, transferIdSchema as wr, RoomMembersOk as wt, CoseHeaderLabel as x, frameVariantSchema as xn, streamSessionSchema as xr, RoomLeave as xt, CoseHeaderAlg as y, execSessionInfoSchema as yn, streamDataFrameSchema as yr, RoomJoin as yt, IceCandidateInit as z, peerAdvertSchema as zn, WebrtcIceCandidate as zt };

package/dist/{protocol-sW8d6Og-.d.mts → protocol-gbXtNeOc.d.mts}

@@ -102,7 +102,11 @@ declare const manageCommandParamsSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodUni
     "1": z.ZodOptional<z.ZodNumber>;
     "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-}, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+}, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+  verb: z.ZodLiteral<"room.rekey">;
+  "key-epoch": z.ZodNumber;
+  "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+}, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
   verb: z.ZodLiteral<"webrtc.offer">;
   "negotiation-id": z.ZodNumber;
   sdp: z.ZodString;
@@ -362,7 +366,11 @@ declare const frameVariantSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.Zod
         "1": z.ZodOptional<z.ZodNumber>;
         "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
       }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+      verb: z.ZodLiteral<"room.rekey">;
+      "key-epoch": z.ZodNumber;
+      "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+    }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
       verb: z.ZodLiteral<"webrtc.offer">;
       "negotiation-id": z.ZodNumber;
       sdp: z.ZodString;
@@ -589,7 +597,11 @@ declare const frameSchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.
         "1": z.ZodOptional<z.ZodNumber>;
         "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
       }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+      verb: z.ZodLiteral<"room.rekey">;
+      "key-epoch": z.ZodNumber;
+      "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+    }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
       verb: z.ZodLiteral<"webrtc.offer">;
       "negotiation-id": z.ZodNumber;
       sdp: z.ZodString;
@@ -787,7 +799,11 @@ declare const manageCommandSchema: z.ZodLazy<z.ZodObject<{
       "1": z.ZodOptional<z.ZodNumber>;
       "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
     }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-  }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+  }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    verb: z.ZodLiteral<"room.rekey">;
+    "key-epoch": z.ZodNumber;
+    "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+  }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
     verb: z.ZodLiteral<"webrtc.offer">;
     "negotiation-id": z.ZodNumber;
     sdp: z.ZodString;
@@ -896,7 +912,11 @@ declare const manageRequestFrameSchema: z.ZodLazy<z.ZodObject<{
         "1": z.ZodOptional<z.ZodNumber>;
         "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
       }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
-    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
+    }, z.core.$catchall<z.ZodUnknown>>>>]>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
+      verb: z.ZodLiteral<"room.rekey">;
+      "key-epoch": z.ZodNumber;
+      "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+    }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodObject<{
       verb: z.ZodLiteral<"webrtc.offer">;
       "negotiation-id": z.ZodNumber;
       sdp: z.ZodString;
@@ -1024,6 +1044,11 @@ declare const roomInviteSchema: z.ZodLazy<z.ZodObject<{
     "4": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   }, z.core.$catchall<z.ZodUnknown>>>>, z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodNull]>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>], null>>>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
+declare const roomRekeySchema: z.ZodLazy<z.ZodObject<{
+  verb: z.ZodLiteral<"room.rekey">;
+  "key-epoch": z.ZodNumber;
+  "wrapped-key": z.ZodUnion<readonly [z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodArray<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>]>;
+}, z.core.$catchall<z.ZodUnknown>>>;
 declare const roomMemberSchema: z.ZodLazy<z.ZodObject<{
   device: z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
@@ -1067,6 +1092,7 @@ declare const roomNoticeClaimsSchema: z.ZodLazy<z.ZodObject<{
     relation: z.ZodString;
   }, z.core.$strip>>>>>;
   "valid-until": z.ZodOptional<z.ZodNumber>;
+  "key-epoch": z.ZodOptional<z.ZodNumber>;
 }, z.core.$catchall<z.ZodUnknown>>>;
 declare const streamSessionSchema: z.ZodLazy<z.ZodNumber>;
 declare const streamDataFrameSchema: z.ZodLazy<z.ZodObject<{
@@ -1279,6 +1305,7 @@ type RoomMembers = z.infer<typeof roomMembersSchema>;
 type MessageRef = z.infer<typeof messageRefSchema>;
 type RoomJoin = z.infer<typeof roomJoinSchema>;
 type RoomInvite = z.infer<typeof roomInviteSchema>;
+type RoomRekey = z.infer<typeof roomRekeySchema>;
 type RoomMember = z.infer<typeof roomMemberSchema>;
 type RoomJoinOk = z.infer<typeof roomJoinOkSchema>;
 type RoomMembersOk = z.infer<typeof roomMembersOkSchema>;
@@ -1319,4 +1346,4 @@ type WebrtcAnswer = z.infer<typeof webrtcAnswerSchema>;
 type WebrtcIceCandidate = z.infer<typeof webrtcIceCandidateSchema>;
 type IceCandidateInit = z.infer<typeof iceCandidateInitSchema>;
 //#endregion
-export { PeerIdentity as $, relayInboundFrameSchema as $n, capabilityTokenSchema as $t, DomainId as A, manageOkSchema as An, StreamAckFrame as At, IdentityKey as B, pingFrameSchema as Bn, WireCandidate as Bt, CoseTokenHeaders as C, handleRecordSchema as Cn, webrtcAnswerSchema as Cr, RoomMembers as Ct, DeviceId as D, manageCommandParamsSchema as Dn, RoomPath as Dt, DataRequestFrame as E, identityKeySchema as En, wireCandidateSchema as Er, RoomNoticeClaims as Et, GossipFrame as F, namespacedDomainIdSchema as Fn, TokenClaims as Ft, ManageRequestFrame as G, procSpawnSchema as Gn, bulkOpenSchema as Gt, ManageCommandParams as H, privateUseDomainIdSchema as Hn, bulkCancelSchema as Ht, HandleClaims as I, observedAddressFrameSchema as In, TransferId as It, NamespacedCapability as J, ptyResizeSchema as Jn, candidatesFrameSchema as Jt, ManageResponseFrame as K, protocolVersionSchema as Kn, bulkResumeSchema as Kt, HandleRecord as L, ownerNamedRoomPathSchema as Ln, WebrtcAnswer as Lt, ExecSessionInfo as M, manageResponseFrameSchema as Mn, StreamEndFrame as Mt, Frame as N, messageRefSchema as Nn, StreamSession as Nt, DeviceIdHex as O, manageCommandSchema as On, RoomRead as Ot, FrameVariant as P, namespacedCapabilitySchema as Pn, SyncPunchFrame as Pt, PeerAdvert as Q, relayDataFrameSchema as Qn, capabilityScopeSchema as Qt, HandshakeFrame as R, peerAdvertSchema as Rn, WebrtcIceCandidate as Rt, CoseSign1 as S, handleClaimsSchema as Sn, transferIdSchema as Sr, RoomMember as St, DataHaveFrame as T, iceCandidateInitSchema as Tn, webrtcOfferSchema as Tr, RoomNotice as Tt, ManageError as U, procKillSchema as Un, bulkDataFrameSchema as Ut, ManageCommand as V, privateUseCapabilitySchema as Vn, bulkAckFrameSchema as Vt, ManageOk as W, procSignalSchema as Wn, bulkEndFrameSchema as Wt, ObservedAddressFrame as X, ptyWriteSchema as Xn, capabilityGrantSchema as Xt, NamespacedDomainId as Y, ptySpawnSchema as Yn, capabilityGrantOkSchema as Yt, OwnerNamedRoomPath as Z, relayConnectFrameSchema as Zn, capabilityRequestSchema as Zt, CoreCapability as _, execListSchema as _n, streamDataFrameSchema as _r, RevocationEntry as _t, BulkOpen as a, coseHeaderAlgSchema as an, roomJoinOkSchema as ar, ProcSpawn as at, CoseHeaderKid as b, frameVariantSchema as bn, syncPunchFrameSchema as br, RoomJoinOk as bt, CandidatesFrame as c, coseSign1Schema as cn, roomMemberSchema as cr, PtyResize as ct, CapabilityRequest as d, dataHaveFrameSchema as dn, roomNoticeClaimsSchema as dr, RelayConnectFrame as dt, capabilityVerbSchema as en, relayOfferFrameSchema as er, PingFrame as et, CapabilityScope as f, dataRequestFrameSchema as fn, roomNoticeSchema as fr, RelayDataFrame as ft, CoordinatorFrame as g, domainIdSchema as gn, streamAckFrameSchema as gr, RevocationClaims as gt, CloseFrame as h, dmRoomPathSchema as hn, roomSendSchema as hr, RevocationAnnounceFrame as ht, BulkEndFrame as i, coreDomainNameSchema as in, roomInviteSchema as ir, ProcSignal as it, ExecList as j, manageRequestFrameSchema as jn, StreamDataFrame as jt, DmRoomPath as k, manageErrorSchema as kn, RoomSend as kt, CapabilityGrant as l, coseTokenHeadersSchema as ln, roomMembersOkSchema as lr, PtySpawn as lt, CapabilityVerb as m, deviceIdSchema as mn, roomReadSchema as mr, RelayOfferFrame as mt, BulkCancel as n, coordinatorFrameSchema as nn, revocationClaimsSchema as nr, PrivateUseDomainId as nt, BulkResume as o, coseHeaderKidSchema as on, roomJoinSchema as or, ProtocolVersion as ot, CapabilityToken as p, deviceIdHexSchema as pn, roomPathSchema as pr, RelayInboundFrame as pt, MessageRef as q, ptyKillSchema as qn, candidateKindSchema as qt, BulkDataFrame as r, coreCapabilitySchema as rn, revocationEntrySchema as rr, ProcKill as rt, CandidateKind as s, coseHeaderLabelSchema as sn, roomLeaveSchema as sr, PtyKill as st, BulkAckFrame as t, closeFrameSchema as tn, revocationAnnounceFrameSchema as tr, PrivateUseCapability as tt, CapabilityGrantOk as u, dataEntriesFrameSchema as un, roomMembersSchema as ur, PtyWrite as ut, CoreDomainName as v, execSessionInfoSchema as vn, streamEndFrameSchema as vr, RoomInvite as vt, DataEntriesFrame as w, handshakeFrameSchema as wn, webrtcIceCandidateSchema as wr, RoomMembersOk as wt, CoseHeaderLabel as x, gossipFrameSchema as xn, tokenClaimsSchema as xr, RoomLeave as xt, CoseHeaderAlg as y, frameSchema as yn, streamSessionSchema as yr, RoomJoin as yt, IceCandidateInit as z, peerIdentitySchema as zn, WebrtcOffer as zt };
+export { PeerIdentity as $, relayDataFrameSchema as $n, capabilityScopeSchema as $t, DomainId as A, manageErrorSchema as An, RoomSend as At, IdentityKey as B, peerIdentitySchema as Bn, WebrtcOffer as Bt, CoseTokenHeaders as C, handleClaimsSchema as Cn, tokenClaimsSchema as Cr, RoomMembers as Ct, DeviceId as D, identityKeySchema as Dn, webrtcOfferSchema as Dr, RoomPath as Dt, DataRequestFrame as E, iceCandidateInitSchema as En, webrtcIceCandidateSchema as Er, RoomNoticeClaims as Et, GossipFrame as F, namespacedCapabilitySchema as Fn, SyncPunchFrame as Ft, ManageRequestFrame as G, procSignalSchema as Gn, bulkEndFrameSchema as Gt, ManageCommandParams as H, privateUseCapabilitySchema as Hn, bulkAckFrameSchema as Ht, HandleClaims as I, namespacedDomainIdSchema as In, TokenClaims as It, NamespacedCapability as J, ptyKillSchema as Jn, candidateKindSchema as Jt, ManageResponseFrame as K, procSpawnSchema as Kn, bulkOpenSchema as Kt, HandleRecord as L, observedAddressFrameSchema as Ln, TransferId as Lt, ExecSessionInfo as M, manageRequestFrameSchema as Mn, StreamDataFrame as Mt, Frame as N, manageResponseFrameSchema as Nn, StreamEndFrame as Nt, DeviceIdHex as O, manageCommandParamsSchema as On, wireCandidateSchema as Or, RoomRead as Ot, FrameVariant as P, messageRefSchema as Pn, StreamSession as Pt, PeerAdvert as Q, relayConnectFrameSchema as Qn, capabilityRequestSchema as Qt, HandshakeFrame as R, ownerNamedRoomPathSchema as Rn, WebrtcAnswer as Rt, CoseSign1 as S, gossipFrameSchema as Sn, syncPunchFrameSchema as Sr, RoomMember as St, DataHaveFrame as T, handshakeFrameSchema as Tn, webrtcAnswerSchema as Tr, RoomNotice as Tt, ManageError as U, privateUseDomainIdSchema as Un, bulkCancelSchema as Ut, ManageCommand as V, pingFrameSchema as Vn, WireCandidate as Vt, ManageOk as W, procKillSchema as Wn, bulkDataFrameSchema as Wt, ObservedAddressFrame as X, ptySpawnSchema as Xn, capabilityGrantOkSchema as Xt, NamespacedDomainId as Y, ptyResizeSchema as Yn, candidatesFrameSchema as Yt, OwnerNamedRoomPath as Z, ptyWriteSchema as Zn, capabilityGrantSchema as Zt, CoreCapability as _, domainIdSchema as _n, roomSendSchema as _r, RevocationEntry as _t, BulkOpen as a, coreDomainNameSchema as an, roomInviteSchema as ar, ProcSpawn as at, CoseHeaderKid as b, frameSchema as bn, streamEndFrameSchema as br, RoomJoinOk as bt, CandidatesFrame as c, coseHeaderLabelSchema as cn, roomLeaveSchema as cr, PtyResize as ct, CapabilityRequest as d, dataEntriesFrameSchema as dn, roomMembersSchema as dr, RelayConnectFrame as dt, capabilityTokenSchema as en, relayInboundFrameSchema as er, PingFrame as et, CapabilityScope as f, dataHaveFrameSchema as fn, roomNoticeClaimsSchema as fr, RelayDataFrame as ft, CoordinatorFrame as g, dmRoomPathSchema as gn, roomRekeySchema as gr, RevocationClaims as gt, CloseFrame as h, deviceIdSchema as hn, roomReadSchema as hr, RevocationAnnounceFrame as ht, BulkEndFrame as i, coreCapabilitySchema as in, revocationEntrySchema as ir, ProcSignal as it, ExecList as j, manageOkSchema as jn, StreamAckFrame as jt, DmRoomPath as k, manageCommandSchema as kn, RoomRekey as kt, CapabilityGrant as l, coseSign1Schema as ln, roomMemberSchema as lr, PtySpawn as lt, CapabilityVerb as m, deviceIdHexSchema as mn, roomPathSchema as mr, RelayOfferFrame as mt, BulkCancel as n, closeFrameSchema as nn, revocationAnnounceFrameSchema as nr, PrivateUseDomainId as nt, BulkResume as o, coseHeaderAlgSchema as on, roomJoinOkSchema as or, ProtocolVersion as ot, CapabilityToken as p, dataRequestFrameSchema as pn, roomNoticeSchema as pr, RelayInboundFrame as pt, MessageRef as q, protocolVersionSchema as qn, bulkResumeSchema as qt, BulkDataFrame as r, coordinatorFrameSchema as rn, revocationClaimsSchema as rr, ProcKill as rt, CandidateKind as s, coseHeaderKidSchema as sn, roomJoinSchema as sr, PtyKill as st, BulkAckFrame as t, capabilityVerbSchema as tn, relayOfferFrameSchema as tr, PrivateUseCapability as tt, CapabilityGrantOk as u, coseTokenHeadersSchema as un, roomMembersOkSchema as ur, PtyWrite as ut, CoreDomainName as v, execListSchema as vn, streamAckFrameSchema as vr, RoomInvite as vt, DataEntriesFrame as w, handleRecordSchema as wn, transferIdSchema as wr, RoomMembersOk as wt, CoseHeaderLabel as x, frameVariantSchema as xn, streamSessionSchema as xr, RoomLeave as xt, CoseHeaderAlg as y, execSessionInfoSchema as yn, streamDataFrameSchema as yr, RoomJoin as yt, IceCandidateInit as z, peerAdvertSchema as zn, WebrtcIceCandidate as zt };

package/dist/{tokens-DfVfE00W.d.cts → tokens-C9Kwy0Gk.d.cts}

@@ -1,5 +1,5 @@
-import { D as DeviceId, Ft as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-sW8d6Og-.cjs";
-import { t as IdentityPort } from "./identity-DJ06jn4k.cjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "./identity-B4XBWkqg.cjs";
 import { t as Clock } from "./clock-DiSx-WKM.cjs";
 import { z } from "zod";
 import { JsonValue, PredicateNode, Resolution } from "trilean";
@@ -36,6 +36,8 @@ type TokenVerdict = {
   claims: TokenClaims;
   /** The device-id at the root of this token's delegation chain: its own issuer when it carries no parent, otherwise the root of its parent's chain. Lets a caller (e.g. core/room's obligation that a chain must terminate at the path's own owner, or the verifier itself for a DM) check the chain's root with one equality comparison instead of re-walking the parent chain a second time. */
   rootIssuer: DeviceId;
+  /** The root ancestor's own self-certifying issuer-key -- already decoded during the walk (every TokenClaims carries its own issuer-key), just threaded up rather than re-derived. Lets a caller compute an ECDH shared secret against the chain's root (e.g. room.rekey's own sender, for a named room whose token chain terminates at the owner) without a separate, out-of-band way to learn that issuer's public key. */
+  rootIssuerKey: IdentityKey;
   /** How many delegation hops this token is from its own root -- 0 for a root grant. Costs nothing extra once rootIssuer is being tracked, and makes the delegation bound observable for diagnostics. */
   depth: number;
 } | {

package/dist/{tokens-VicRWTj1.mjs → tokens-CdQwzCyJ.mjs}

@@ -310,6 +310,7 @@ async function verifyTokenChain(token, options) {
 			ok: true,
 			claims,
 			rootIssuer: parentVerdict.rootIssuer,
+			rootIssuerKey: parentVerdict.rootIssuerKey,
 			depth: parentVerdict.depth + 1
 		};
 	}
@@ -317,6 +318,7 @@ async function verifyTokenChain(token, options) {
 		ok: true,
 		claims,
 		rootIssuer: claims.issuer,
+		rootIssuerKey: claims["issuer-key"],
 		depth: 0
 	};
 }

package/dist/{tokens-CiNXdKJ8.cjs → tokens-DxGVURpB.cjs}

@@ -310,6 +310,7 @@ async function verifyTokenChain(token, options) {
 			ok: true,
 			claims,
 			rootIssuer: parentVerdict.rootIssuer,
+			rootIssuerKey: parentVerdict.rootIssuerKey,
 			depth: parentVerdict.depth + 1
 		};
 	}
@@ -317,6 +318,7 @@ async function verifyTokenChain(token, options) {
 		ok: true,
 		claims,
 		rootIssuer: claims.issuer,
+		rootIssuerKey: claims["issuer-key"],
 		depth: 0
 	};
 }

package/dist/{tokens-CpLDI5Fo.d.mts → tokens-k172l0Iy.d.mts}

@@ -1,5 +1,5 @@
-import { D as DeviceId, Ft as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-sW8d6Og-.mjs";
-import { t as IdentityPort } from "./identity-C5N86BPz.mjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "./identity-CIb9dGkJ.mjs";
 import { t as Clock } from "./clock-DiSx-WKM.mjs";
 import { z } from "zod";
 import { JsonValue, PredicateNode, Resolution } from "trilean";
@@ -36,6 +36,8 @@ type TokenVerdict = {
   claims: TokenClaims;
   /** The device-id at the root of this token's delegation chain: its own issuer when it carries no parent, otherwise the root of its parent's chain. Lets a caller (e.g. core/room's obligation that a chain must terminate at the path's own owner, or the verifier itself for a DM) check the chain's root with one equality comparison instead of re-walking the parent chain a second time. */
   rootIssuer: DeviceId;
+  /** The root ancestor's own self-certifying issuer-key -- already decoded during the walk (every TokenClaims carries its own issuer-key), just threaded up rather than re-derived. Lets a caller compute an ECDH shared secret against the chain's root (e.g. room.rekey's own sender, for a named room whose token chain terminates at the owner) without a separate, out-of-band way to learn that issuer's public key. */
+  rootIssuerKey: IdentityKey;
   /** How many delegation hops this token is from its own root -- 0 for a root grant. Costs nothing extra once rootIssuer is being tracked, and makes the delegation bound observable for diagnostics. */
   depth: number;
 } | {

package/dist/{transport-B5E896PN.d.mts → transport-DAsFqDDS.d.cts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-sW8d6Og-.mjs";
+import { D as DeviceId, N as Frame } from "./protocol-gbXtNeOc.cjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/dist/{transport-DxZ4JWZc.d.cts → transport-Dy4h2eNY.d.mts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-sW8d6Og-.cjs";
+import { D as DeviceId, N as Frame } from "./protocol-gbXtNeOc.mjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "type": "module",
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {
@@ -114,6 +114,10 @@
       "import": "./dist/domain/grant-candidates.mjs",
       "require": "./dist/domain/grant-candidates.cjs"
     },
+    "./domain/group-key": {
+      "import": "./dist/domain/group-key.mjs",
+      "require": "./dist/domain/group-key.cjs"
+    },
     "./domain/handshake": {
       "import": "./dist/domain/handshake.mjs",
       "require": "./dist/domain/handshake.cjs"
@@ -142,6 +146,10 @@
       "import": "./dist/domain/room-path.mjs",
       "require": "./dist/domain/room-path.cjs"
     },
+    "./domain/room-rekey": {
+      "import": "./dist/domain/room-rekey.mjs",
+      "require": "./dist/domain/room-rekey.cjs"
+    },
     "./domain/room-token-verification": {
       "import": "./dist/domain/room-token-verification.mjs",
       "require": "./dist/domain/room-token-verification.cjs"