wire-mesh-core 1.59.0 → 2.0.0

package/dist/domain/peer-advert.d.cts

@@ -0,0 +1,45 @@
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-Bi2fzBCc.cjs";
+import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+//#region src/domain/peer-advert.d.ts
+/** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
+export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";
+/** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
+export declare const PEER_ADVERT_IDENTITY_KEY_KEY = "identity-key";
+/**
+ * The domain-separation prefix every peer-advert signature is computed over, per spec/transport.cddl: the ASCII string "wire-mesh/peer-advert/v1" followed by one zero byte.
+ *
+ * Deliberately not tokens.cddl's COSE Sig_structure, which every other signature in this codebase reuses via sig1ToBeSigned. An advert's extension tail is an open `* tstr => any` map, so an attacker can craft an advert whose canonical encoding also satisfies token-claims; a Sig_structure over that encoding would then be replayable as a capability token's own signed payload. This prefix makes the two byte strings disjoint by construction, since a Sig_structure always begins with the CBOR head of a 4-element array (0x84) rather than the ASCII "w" this one starts with.
+ */
+export declare const PEER_ADVERT_SIGNING_CONTEXT: Uint8Array<ArrayBuffer>;
+/**
+ * Everything a peer-advert's signature covers: the whole advert apart from `signature` itself. Spelled out as its own interface rather than derived with `Omit<PeerAdvert, "signature">`, which collapses to the bare index signature because peer-advert's open extension tail makes `keyof PeerAdvert` a plain `string`.
+ *
+ * A full PeerAdvert satisfies this structurally, which is what lets peerAdvertSigningInput take either an advert being signed or one being verified without a second overload.
+ */
+export interface UnsignedPeerAdvert {
+  readonly device: DeviceId;
+  readonly addresses: string[];
+  readonly "snapshot-seconds": number;
+  readonly "identity-key": IdentityKey;
+  /** peer-advert's own open extension tail (spec/CONVENTIONS.md's gossip-extension-namespacing convention). Every key here is signed over too, so nothing in the tail can be added, altered, or dropped without invalidating the advert. */
+  readonly [key: string]: unknown;
+}
+/** The crypto primitives verification needs, and nothing else: an advert is self-certifying, so a verifier never consults its own device-id or private key to check one. Narrowed from IdentityPort so a relay hub, which has no reason to hold a signing identity, can be given a verifier without one. */
+export type PeerAdvertVerifier = Pick<IdentityPort, "verify" | "deriveDeviceId">;
+/** The signing half's own dependency: a node only ever signs adverts naming itself, which is exactly why a gateway forwards its local peers' adverts verbatim instead of re-signing them. */
+export type PeerAdvertSigner = Pick<IdentityPort, "sign">;
+/**
+ * The exact bytes a peer-advert's signature is computed over: PEER_ADVERT_SIGNING_CONTEXT followed by the canonical CDE encoding of the advert with its `signature` entry removed and nothing else changed.
+ *
+ * Takes the advert rather than a pre-stripped copy so a verifier derives the input from precisely the bytes it received, leaving no room for the signed and checked views of an advert to disagree.
+ */
+export declare function peerAdvertSigningInput(advert: Readonly<UnsignedPeerAdvert>): Uint8Array<ArrayBuffer>;
+/** Signs an advert's content into the complete peer-advert that goes on the wire. The caller supplies `device` and `identity-key` itself rather than having them read off the signer, since the signer port carries only `sign`: a node building its own self-advert already holds both, and nothing else may legitimately sign an advert at all. */
+export declare function signPeerAdvert(identity: Readonly<PeerAdvertSigner>, advert: Readonly<UnsignedPeerAdvert>): Promise<PeerAdvert>;
+/**
+ * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
+ *
+ * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+ */
+export declare function verifyPeerAdvert(identity: Readonly<PeerAdvertVerifier>, advert: Readonly<PeerAdvert>): Promise<boolean>;
+//#endregion

package/dist/domain/peer-advert.d.mts

@@ -0,0 +1,45 @@
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-Bi2fzBCc.mjs";
+import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+//#region src/domain/peer-advert.d.ts
+/** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
+export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";
+/** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
+export declare const PEER_ADVERT_IDENTITY_KEY_KEY = "identity-key";
+/**
+ * The domain-separation prefix every peer-advert signature is computed over, per spec/transport.cddl: the ASCII string "wire-mesh/peer-advert/v1" followed by one zero byte.
+ *
+ * Deliberately not tokens.cddl's COSE Sig_structure, which every other signature in this codebase reuses via sig1ToBeSigned. An advert's extension tail is an open `* tstr => any` map, so an attacker can craft an advert whose canonical encoding also satisfies token-claims; a Sig_structure over that encoding would then be replayable as a capability token's own signed payload. This prefix makes the two byte strings disjoint by construction, since a Sig_structure always begins with the CBOR head of a 4-element array (0x84) rather than the ASCII "w" this one starts with.
+ */
+export declare const PEER_ADVERT_SIGNING_CONTEXT: Uint8Array<ArrayBuffer>;
+/**
+ * Everything a peer-advert's signature covers: the whole advert apart from `signature` itself. Spelled out as its own interface rather than derived with `Omit<PeerAdvert, "signature">`, which collapses to the bare index signature because peer-advert's open extension tail makes `keyof PeerAdvert` a plain `string`.
+ *
+ * A full PeerAdvert satisfies this structurally, which is what lets peerAdvertSigningInput take either an advert being signed or one being verified without a second overload.
+ */
+export interface UnsignedPeerAdvert {
+  readonly device: DeviceId;
+  readonly addresses: string[];
+  readonly "snapshot-seconds": number;
+  readonly "identity-key": IdentityKey;
+  /** peer-advert's own open extension tail (spec/CONVENTIONS.md's gossip-extension-namespacing convention). Every key here is signed over too, so nothing in the tail can be added, altered, or dropped without invalidating the advert. */
+  readonly [key: string]: unknown;
+}
+/** The crypto primitives verification needs, and nothing else: an advert is self-certifying, so a verifier never consults its own device-id or private key to check one. Narrowed from IdentityPort so a relay hub, which has no reason to hold a signing identity, can be given a verifier without one. */
+export type PeerAdvertVerifier = Pick<IdentityPort, "verify" | "deriveDeviceId">;
+/** The signing half's own dependency: a node only ever signs adverts naming itself, which is exactly why a gateway forwards its local peers' adverts verbatim instead of re-signing them. */
+export type PeerAdvertSigner = Pick<IdentityPort, "sign">;
+/**
+ * The exact bytes a peer-advert's signature is computed over: PEER_ADVERT_SIGNING_CONTEXT followed by the canonical CDE encoding of the advert with its `signature` entry removed and nothing else changed.
+ *
+ * Takes the advert rather than a pre-stripped copy so a verifier derives the input from precisely the bytes it received, leaving no room for the signed and checked views of an advert to disagree.
+ */
+export declare function peerAdvertSigningInput(advert: Readonly<UnsignedPeerAdvert>): Uint8Array<ArrayBuffer>;
+/** Signs an advert's content into the complete peer-advert that goes on the wire. The caller supplies `device` and `identity-key` itself rather than having them read off the signer, since the signer port carries only `sign`: a node building its own self-advert already holds both, and nothing else may legitimately sign an advert at all. */
+export declare function signPeerAdvert(identity: Readonly<PeerAdvertSigner>, advert: Readonly<UnsignedPeerAdvert>): Promise<PeerAdvert>;
+/**
+ * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
+ *
+ * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+ */
+export declare function verifyPeerAdvert(identity: Readonly<PeerAdvertVerifier>, advert: Readonly<PeerAdvert>): Promise<boolean>;
+//#endregion

package/dist/domain/peer-advert.mjs

@@ -0,0 +1,55 @@
+import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { cdeEncodeOptions, encode } from "cbor2";
+//#region src/domain/peer-advert.ts
+/** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
+const PEER_ADVERT_SIGNATURE_KEY = "signature";
+/** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
+const PEER_ADVERT_IDENTITY_KEY_KEY = "identity-key";
+/**
+* The domain-separation prefix every peer-advert signature is computed over, per spec/transport.cddl: the ASCII string "wire-mesh/peer-advert/v1" followed by one zero byte.
+*
+* Deliberately not tokens.cddl's COSE Sig_structure, which every other signature in this codebase reuses via sig1ToBeSigned. An advert's extension tail is an open `* tstr => any` map, so an attacker can craft an advert whose canonical encoding also satisfies token-claims; a Sig_structure over that encoding would then be replayable as a capability token's own signed payload. This prefix makes the two byte strings disjoint by construction, since a Sig_structure always begins with the CBOR head of a 4-element array (0x84) rather than the ASCII "w" this one starts with.
+*/
+const PEER_ADVERT_SIGNING_CONTEXT = new TextEncoder().encode("wire-mesh/peer-advert/v1\0");
+/**
+* The exact bytes a peer-advert's signature is computed over: PEER_ADVERT_SIGNING_CONTEXT followed by the canonical CDE encoding of the advert with its `signature` entry removed and nothing else changed.
+*
+* Takes the advert rather than a pre-stripped copy so a verifier derives the input from precisely the bytes it received, leaving no room for the signed and checked views of an advert to disagree.
+*/
+function peerAdvertSigningInput(advert) {
+	const content = {};
+	for (const [key, value] of Object.entries(advert)) {
+		if (key === "signature") continue;
+		content[key] = value;
+	}
+	const encoded = encode(content, cdeEncodeOptions);
+	const input = new Uint8Array(PEER_ADVERT_SIGNING_CONTEXT.length + encoded.length);
+	input.set(PEER_ADVERT_SIGNING_CONTEXT, 0);
+	input.set(encoded, PEER_ADVERT_SIGNING_CONTEXT.length);
+	return input;
+}
+/** Signs an advert's content into the complete peer-advert that goes on the wire. The caller supplies `device` and `identity-key` itself rather than having them read off the signer, since the signer port carries only `sign`: a node building its own self-advert already holds both, and nothing else may legitimately sign an advert at all. */
+async function signPeerAdvert(identity, advert) {
+	const signature = await identity.sign(peerAdvertSigningInput(advert));
+	return {
+		...advert,
+		[PEER_ADVERT_SIGNATURE_KEY]: signature
+	};
+}
+/**
+* Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
+*
+* Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+*/
+async function verifyPeerAdvert(identity, advert) {
+	const key = advert[PEER_ADVERT_IDENTITY_KEY_KEY];
+	try {
+		const derived = await identity.deriveDeviceId(key["public-key"]);
+		if (!bytesEqual(derived, advert.device)) return false;
+		return await identity.verify(key, peerAdvertSigningInput(advert), advert[PEER_ADVERT_SIGNATURE_KEY]);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { PEER_ADVERT_IDENTITY_KEY_KEY, PEER_ADVERT_SIGNATURE_KEY, PEER_ADVERT_SIGNING_CONTEXT, peerAdvertSigningInput, signPeerAdvert, verifyPeerAdvert };

package/dist/domain/relay-hub.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_peer_advert = require("./peer-advert.cjs");
 //#region src/domain/relay-hub.ts
 const HEX_RADIX = 16;
 const HEX_DIGITS_PER_BYTE = 2;
@@ -13,7 +14,17 @@ function deviceFromKey(key) {
 	for (let i = 0; i < device.length; i++) device[i] = Number.parseInt(key.slice(i * HEX_DIGITS_PER_BYTE, (i + 1) * HEX_DIGITS_PER_BYTE), HEX_RADIX);
 	return device;
 }
-function createRelayHub(options = {}) {
+/**
+* Whether an already-verified advert may take over the registration a device currently holds (wire-mesh#225).
+*
+* Strictly newer when it arrives on a different connection from the one holding the registration, so replaying a victim's genuine advert, which carries the victim's own `snapshot-seconds` unchanged since altering it would break the signature, can never steal its route. Newer-or-equal from the connection that already holds it, so an unchanged heartbeat from the rightful owner still refreshes the addresses and extensions the hub replays in catch-up frames.
+*/
+function supersedes(registered, advert, connection) {
+	const incoming = advert["snapshot-seconds"];
+	const held = registered.advert["snapshot-seconds"];
+	return registered.connection === connection ? incoming >= held : incoming > held;
+}
+function createRelayHub(options) {
 	const connections = /* @__PURE__ */ new Set();
 	const devices = /* @__PURE__ */ new Map();
 	const connectionDevice = /* @__PURE__ */ new Map();
@@ -101,25 +112,34 @@ function createRelayHub(options = {}) {
 	async function handleFrame(connection, frame) {
 		if (frame.type === "gossip") {
 			const supplanted = /* @__PURE__ */ new Set();
+			const accepted = [];
 			for (const advert of frame.peers) {
+				if (!await require_domain_peer_advert.verifyPeerAdvert(options.identity, advert)) continue;
 				const key = deviceKey(advert.device);
 				const previous = devices.get(key);
+				if (previous !== void 0 && !supersedes(previous, advert, connection)) continue;
 				if (previous !== void 0 && previous.connection !== connection) supplanted.add(previous.connection);
 				devices.set(key, {
 					connection,
 					advert
 				});
+				accepted.push(advert);
 			}
+			if (accepted.length === 0) return;
 			for (const registration of devices.values()) if (registration.connection === connection) {
 				connectionDevice.set(connection, registration.advert.device);
 				break;
 			}
 			stateChanged(connection);
 			for (const other of supplanted) stateChanged(other);
+			const forwarded = {
+				type: "gossip",
+				peers: accepted
+			};
 			for (const other of connections) {
 				if (other === connection) continue;
 				try {
-					await other.send(frame);
+					await other.send(forwarded);
 				} catch {}
 			}
 			const catchUp = [];

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,6 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-BnbpCk0Z.cjs";
-import { t as Connection } from "../transport-Ca_ZyyZe.cjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-Bi2fzBCc.cjs";
+import { t as Connection } from "../transport-Cq_odHy3.cjs";
+import { PeerAdvertVerifier } from "./peer-advert.cjs";
 //#region src/domain/relay-hub.d.ts
 /**
  * One connection's relay state in serialisable form: everything a hub that never saw the connection register needs, alongside the still-open connection itself, to answer its next frame exactly as the hub that established the state would have. Only device-ids and adverts appear, never a Connection, so a host can persist this wherever it keeps per-connection state.
@@ -20,6 +21,8 @@ export interface RelayConnectionRestore {
   readonly state: RelayConnectionState;
 }
 export interface RelayHubOptions {
+  /** The crypto primitives this hub verifies every gossiped advert with (wire-mesh#225). Narrowed to verify/deriveDeviceId rather than a full IdentityPort because an advert is self-certifying: a hub checks one against the key the advert itself carries, and never needs a signing identity of its own to do it. */
+  readonly identity: Readonly<PeerAdvertVerifier>;
   /** Called whenever the value exportConnection returns for a connection changes: it gossiped an advert, gained or lost a pairing, or had one of its adverts taken over by another connection. A host whose own instance can be torn down while its connections stay open (the Cloudflare hub's hibernating Durable Object) reads the new value back with exportConnection, persists it against the connection, and hands it to a later instance through restoreConnections. */
   readonly onConnectionStateChanged?: (connection: Readonly<Connection>) => void;
 }
@@ -39,5 +42,5 @@ export interface RelayHub {
   /** Drops all registry and pairing state -- used by tests and by transport teardown. */
   stop: () => void;
 }
-export declare function createRelayHub(options?: RelayHubOptions): RelayHub;
+export declare function createRelayHub(options: Readonly<RelayHubOptions>): RelayHub;
 //#endregion

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,6 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-BnbpCk0Z.mjs";
-import { t as Connection } from "../transport-BH8kGWXt.mjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-Bi2fzBCc.mjs";
+import { t as Connection } from "../transport-GcJ4LYVE.mjs";
+import { PeerAdvertVerifier } from "./peer-advert.mjs";
 //#region src/domain/relay-hub.d.ts
 /**
  * One connection's relay state in serialisable form: everything a hub that never saw the connection register needs, alongside the still-open connection itself, to answer its next frame exactly as the hub that established the state would have. Only device-ids and adverts appear, never a Connection, so a host can persist this wherever it keeps per-connection state.
@@ -20,6 +21,8 @@ export interface RelayConnectionRestore {
   readonly state: RelayConnectionState;
 }
 export interface RelayHubOptions {
+  /** The crypto primitives this hub verifies every gossiped advert with (wire-mesh#225). Narrowed to verify/deriveDeviceId rather than a full IdentityPort because an advert is self-certifying: a hub checks one against the key the advert itself carries, and never needs a signing identity of its own to do it. */
+  readonly identity: Readonly<PeerAdvertVerifier>;
   /** Called whenever the value exportConnection returns for a connection changes: it gossiped an advert, gained or lost a pairing, or had one of its adverts taken over by another connection. A host whose own instance can be torn down while its connections stay open (the Cloudflare hub's hibernating Durable Object) reads the new value back with exportConnection, persists it against the connection, and hands it to a later instance through restoreConnections. */
   readonly onConnectionStateChanged?: (connection: Readonly<Connection>) => void;
 }
@@ -39,5 +42,5 @@ export interface RelayHub {
   /** Drops all registry and pairing state -- used by tests and by transport teardown. */
   stop: () => void;
 }
-export declare function createRelayHub(options?: RelayHubOptions): RelayHub;
+export declare function createRelayHub(options: Readonly<RelayHubOptions>): RelayHub;
 //#endregion

package/dist/domain/relay-hub.mjs

@@ -1,3 +1,4 @@
+import { verifyPeerAdvert } from "./peer-advert.mjs";
 //#region src/domain/relay-hub.ts
 const HEX_RADIX = 16;
 const HEX_DIGITS_PER_BYTE = 2;
@@ -12,7 +13,17 @@ function deviceFromKey(key) {
 	for (let i = 0; i < device.length; i++) device[i] = Number.parseInt(key.slice(i * HEX_DIGITS_PER_BYTE, (i + 1) * HEX_DIGITS_PER_BYTE), HEX_RADIX);
 	return device;
 }
-function createRelayHub(options = {}) {
+/**
+* Whether an already-verified advert may take over the registration a device currently holds (wire-mesh#225).
+*
+* Strictly newer when it arrives on a different connection from the one holding the registration, so replaying a victim's genuine advert, which carries the victim's own `snapshot-seconds` unchanged since altering it would break the signature, can never steal its route. Newer-or-equal from the connection that already holds it, so an unchanged heartbeat from the rightful owner still refreshes the addresses and extensions the hub replays in catch-up frames.
+*/
+function supersedes(registered, advert, connection) {
+	const incoming = advert["snapshot-seconds"];
+	const held = registered.advert["snapshot-seconds"];
+	return registered.connection === connection ? incoming >= held : incoming > held;
+}
+function createRelayHub(options) {
 	const connections = /* @__PURE__ */ new Set();
 	const devices = /* @__PURE__ */ new Map();
 	const connectionDevice = /* @__PURE__ */ new Map();
@@ -100,25 +111,34 @@ function createRelayHub(options = {}) {
 	async function handleFrame(connection, frame) {
 		if (frame.type === "gossip") {
 			const supplanted = /* @__PURE__ */ new Set();
+			const accepted = [];
 			for (const advert of frame.peers) {
+				if (!await verifyPeerAdvert(options.identity, advert)) continue;
 				const key = deviceKey(advert.device);
 				const previous = devices.get(key);
+				if (previous !== void 0 && !supersedes(previous, advert, connection)) continue;
 				if (previous !== void 0 && previous.connection !== connection) supplanted.add(previous.connection);
 				devices.set(key, {
 					connection,
 					advert
 				});
+				accepted.push(advert);
 			}
+			if (accepted.length === 0) return;
 			for (const registration of devices.values()) if (registration.connection === connection) {
 				connectionDevice.set(connection, registration.advert.device);
 				break;
 			}
 			stateChanged(connection);
 			for (const other of supplanted) stateChanged(other);
+			const forwarded = {
+				type: "gossip",
+				peers: accepted
+			};
 			for (const other of connections) {
 				if (other === connection) continue;
 				try {
-					await other.send(frame);
+					await other.send(forwarded);
 				} catch {}
 			}
 			const catchUp = [];

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BnbpCk0Z.cjs";
-import { t as Connection } from "../transport-Ca_ZyyZe.cjs";
+import { N as Frame } from "../protocol-Bi2fzBCc.cjs";
+import { t as Connection } from "../transport-Cq_odHy3.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BnbpCk0Z.mjs";
-import { t as Connection } from "../transport-BH8kGWXt.mjs";
+import { N as Frame } from "../protocol-Bi2fzBCc.mjs";
+import { t as Connection } from "../transport-GcJ4LYVE.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-BnbpCk0Z.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-BL2BzOmN.cjs";
+import { bt as RevocationEntry } from "../protocol-Bi2fzBCc.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-BDVxEvl2.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-BnbpCk0Z.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DtjdYS_a.mjs";
+import { bt as RevocationEntry } from "../protocol-Bi2fzBCc.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-0r9ipK1r.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/room-rekey.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BnbpCk0Z.cjs";
-import { t as IdentityPort } from "../identity-BRlM-Krs.cjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-Bi2fzBCc.cjs";
+import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-BL2BzOmN.cjs";
+import { a as RevocationCheck } from "../tokens-BDVxEvl2.cjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-rekey.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BnbpCk0Z.mjs";
-import { t as IdentityPort } from "../identity-DiuayfEd.mjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-Bi2fzBCc.mjs";
+import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-DtjdYS_a.mjs";
+import { a as RevocationCheck } from "../tokens-0r9ipK1r.mjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-token-verification.d.cts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-D9ogJTO3.cjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CDXkm_Tg.cjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.d.mts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-NjaqYY4k.mjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CnHNaA8J.mjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room.d.cts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BnbpCk0Z.cjs";
-import { t as IdentityPort } from "../identity-BRlM-Krs.cjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-Bi2fzBCc.cjs";
+import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-BL2BzOmN.cjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-D9ogJTO3.cjs";
+import { a as RevocationCheck } from "../tokens-BDVxEvl2.cjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-CDXkm_Tg.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/room.d.mts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BnbpCk0Z.mjs";
-import { t as IdentityPort } from "../identity-DiuayfEd.mjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-Bi2fzBCc.mjs";
+import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-DtjdYS_a.mjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-NjaqYY4k.mjs";
+import { a as RevocationCheck } from "../tokens-0r9ipK1r.mjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-CnHNaA8J.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/shard-manifest.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BnbpCk0Z.cjs";
+import { D as DeviceId } from "../protocol-Bi2fzBCc.cjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.cjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/shard-manifest.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BnbpCk0Z.mjs";
+import { D as DeviceId } from "../protocol-Bi2fzBCc.mjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.mjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-BL2BzOmN.cjs";
+import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-BDVxEvl2.cjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-DtjdYS_a.mjs";
+import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-0r9ipK1r.mjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/topology-snapshot.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, en as TopologyPeers } from "../protocol-BnbpCk0Z.cjs";
+import { D as DeviceId, en as TopologyPeers } from "../protocol-Bi2fzBCc.cjs";
 //#region src/domain/topology-snapshot.d.ts
 export interface TopologyPeersInputs {
   /** connection?.peerDeviceId -- the transport-authenticated direct peer, when the adapter gives one. Takes priority over firstAdvertisedPeer below. */

package/dist/domain/topology-snapshot.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, en as TopologyPeers } from "../protocol-BnbpCk0Z.mjs";
+import { D as DeviceId, en as TopologyPeers } from "../protocol-Bi2fzBCc.mjs";
 //#region src/domain/topology-snapshot.d.ts
 export interface TopologyPeersInputs {
   /** connection?.peerDeviceId -- the transport-authenticated direct peer, when the adapter gives one. Takes priority over firstAdvertisedPeer below. */

package/dist/domain/topology.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_gossip_extensions = require("../gossip-extensions-Dr_T7hk_.cjs");
+const require_gossip_extensions = require("../gossip-extensions-DRVTHKnR.cjs");
 //#region src/domain/topology.ts
 /**
 * Topology introspection (wire-mesh#180): assembling a connection graph out of every device's own self-reported `topology/peers` gossip extension (mesh-session.ts's buildSelfAdvert computes and injects it automatically -- nothing here writes to it), and answering the on-demand `topology.get` manage-command for a live, cache-bust read instead of a possibly-stale gossiped one. `topology:get` is deliberately ungated, per management.cddl's own comment on `topology-get` and this registry entry -- no token/scope check anywhere in this module, mirroring how core/room's room.join/room.invite are ungated in room-client.ts.

package/dist/domain/topology.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, V as ManageCommand, en as TopologyPeers, et as PeerAdvert } from "../protocol-BnbpCk0Z.cjs";
+import { D as DeviceId, V as ManageCommand, en as TopologyPeers, et as PeerAdvert } from "../protocol-Bi2fzBCc.cjs";
 import { DirectoryEntry, IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/topology.d.ts
 export declare const TOPOLOGY_GET_CAPABILITY = "topology:get";

package/dist/domain/topology.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, V as ManageCommand, en as TopologyPeers, et as PeerAdvert } from "../protocol-BnbpCk0Z.mjs";
+import { D as DeviceId, V as ManageCommand, en as TopologyPeers, et as PeerAdvert } from "../protocol-Bi2fzBCc.mjs";
 import { DirectoryEntry, IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/topology.d.ts
 export declare const TOPOLOGY_GET_CAPABILITY = "topology:get";

package/dist/domain/topology.mjs

@@ -1,5 +1,5 @@
 import { topologyGetSchema, topologyPeersSchema } from "../generated/protocol.mjs";
-import { t as TOPOLOGY_PEERS_GOSSIP_KEY } from "../gossip-extensions-Cdy5mQhY.mjs";
+import { t as TOPOLOGY_PEERS_GOSSIP_KEY } from "../gossip-extensions-BNiI44sU.mjs";
 //#region src/domain/topology.ts
 /**
 * Topology introspection (wire-mesh#180): assembling a connection graph out of every device's own self-reported `topology/peers` gossip extension (mesh-session.ts's buildSelfAdvert computes and injects it automatically -- nothing here writes to it), and answering the on-demand `topology.get` manage-command for a live, cache-bust read instead of a possibly-stale gossiped one. `topology:get` is deliberately ungated, per management.cddl's own comment on `topology-get` and this registry entry -- no token/scope check anywhere in this module, mirroring how core/room's room.join/room.invite are ungated in room-client.ts.

package/dist/domain/webrtc-signaling.d.cts

@@ -1,6 +1,6 @@
-import { Ft as SfuTrackEntry, H as ManageCommandParams, It as SfuTrackMap, V as ManageCommand, an as WebrtcOffer, f as CapabilityScope, in as WebrtcIceCandidate, rn as WebrtcAnswer, z as IceCandidateInit } from "../protocol-BnbpCk0Z.cjs";
+import { Ft as SfuTrackEntry, H as ManageCommandParams, It as SfuTrackMap, V as ManageCommand, an as WebrtcOffer, f as CapabilityScope, in as WebrtcIceCandidate, rn as WebrtcAnswer, z as IceCandidateInit } from "../protocol-Bi2fzBCc.cjs";
 import { IncomingManageRequest } from "./mesh-session.cjs";
-import { u as VerifyCapabilityTokenOptions } from "../tokens-BL2BzOmN.cjs";
+import { u as VerifyCapabilityTokenOptions } from "../tokens-BDVxEvl2.cjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.d.mts

@@ -1,6 +1,6 @@
-import { Ft as SfuTrackEntry, H as ManageCommandParams, It as SfuTrackMap, V as ManageCommand, an as WebrtcOffer, f as CapabilityScope, in as WebrtcIceCandidate, rn as WebrtcAnswer, z as IceCandidateInit } from "../protocol-BnbpCk0Z.mjs";
+import { Ft as SfuTrackEntry, H as ManageCommandParams, It as SfuTrackMap, V as ManageCommand, an as WebrtcOffer, f as CapabilityScope, in as WebrtcIceCandidate, rn as WebrtcAnswer, z as IceCandidateInit } from "../protocol-Bi2fzBCc.mjs";
 import { IncomingManageRequest } from "./mesh-session.mjs";
-import { u as VerifyCapabilityTokenOptions } from "../tokens-DtjdYS_a.mjs";
+import { u as VerifyCapabilityTokenOptions } from "../tokens-0r9ipK1r.mjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/generated/protocol.cjs

@@ -467,7 +467,9 @@ const closeFrameSchema = zod.z.lazy(() => zod.z.object({
 const peerAdvertSchema = zod.z.lazy(() => zod.z.object({
 	"device": zod.z.lazy(() => deviceIdSchema),
 	"addresses": zod.z.array(zod.z.string()),
-	"snapshot-seconds": zod.z.number().int()
+	"snapshot-seconds": zod.z.number().int(),
+	"identity-key": zod.z.lazy(() => identityKeySchema),
+	"signature": zod.z.instanceof(Uint8Array)
 }).catchall(zod.z.unknown()));
 const gossipFrameSchema = zod.z.lazy(() => zod.z.object({
 	"type": zod.z.literal("gossip"),

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as PathTraceOk, $n as messageRefSchema, $r as thresholdKeygenRound2Schema, $t as TopologyGet, A as DomainId, An as dataEntriesFrameSchema, Ar as roomLeaveSchema, At as RoomPath, B as IdentityKey, Bn as frameVariantSchema, Br as sessionIdSchema, Bt as StreamSession, C as CoseTokenHeaders, Cn as coreCapabilitySchema, Cr as relayOfferFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderLabelSchema, Dr as roomInviteSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coseHeaderKidSchema, Er as revocationEntrySchema, Et as RoomMembers, F as GossipFrame, Fn as dmRoomPathSchema, Fr as roomNoticeSchema, Ft as SfuTrackEntry, G as ManageRequestFrame, Gn as iceCandidateInitSchema, Gr as streamEndFrameSchema, Gt as ThresholdKeygenConfirm, H as ManageCommandParams, Hn as handleClaimsSchema, Hr as sfuTrackMapSchema, Ht as ThresholdAbort, I as HandleClaims, In as domainIdSchema, Ir as roomPathSchema, It as SfuTrackMap, J as NamespacedCapability, Jn as manageCommandSchema, Jr as thresholdAbortSchema, Jt as ThresholdShareClaims, K as ManageResponseFrame, Kn as identityKeySchema, Kr as streamSessionSchema, Kt as ThresholdKeygenRound1, L as HandleRecord, Ln as execListSchema, Lr as roomReadSchema, Lt as StreamAckFrame, M as ExecSessionInfo, Mn as dataRequestFrameSchema, Mr as roomMembersOkSchema, Mt as RoomRekey, N as Frame, Nn as deviceIdHexSchema, Nr as roomMembersSchema, Nt as RoomSend, O as DeviceIdHex, On as coseSign1Schema, Or as roomJoinOkSchema, Ot as RoomNotice, P as FrameVariant, Pn as deviceIdSchema, Pr as roomNoticeClaimsSchema, Pt as SessionId, Q as PathTrace, Qn as manageResponseFrameSchema, Qr as thresholdKeygenRound1Schema, Qt as TokenClaims, R as HandshakeFrame, Rn as execSessionInfoSchema, Rr as roomRekeySchema, Rt as StreamDataFrame, S as CoseSign1, Sn as coordinatorFrameSchema, Sr as relayInboundFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coseHeaderAlgSchema, Tr as revocationClaimsSchema, Tt as RoomMember, U as ManageError, Un as handleRecordSchema, Ur as streamAckFrameSchema, Ut as ThresholdCommit, V as ManageCommand, Vn as gossipFrameSchema, Vr as sfuTrackEntrySchema, Vt as SyncPunchFrame, W as ManageOk, Wn as handshakeFrameSchema, Wr as streamDataFrameSchema, Wt as ThresholdCommitment, X as ObservedAddressFrame, Xn as manageOkSchema, Xr as thresholdCommitmentSchema, Xt as ThresholdSign, Y as NamespacedDomainId, Yn as manageErrorSchema, Yr as thresholdCommitSchema, Yt as ThresholdShareEnvelope, Z as OwnerNamedRoomPath, Zn as manageRequestFrameSchema, Zr as thresholdKeygenConfirmSchema, Zt as ThresholdSubject, _ as CoreCapability, _n as capabilityRequestSchema, _r as ptyResizeSchema, _t as RelayOfferFrame, a as BulkOpen, ai as topologyGetSchema, an as WebrtcOffer, ar as pathTraceSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityVerbSchema, br as relayConnectFrameSchema, bt as RevocationEntry, c as CandidatesFrame, ci as versionGetSchema, cn as bulkCancelSchema, cr as pingFrameSchema, ct as ProcSpawn, d as CapabilityRequest, di as webrtcOfferSchema, dn as bulkOpenSchema, dr as privateUseDomainIdSchema, dt as PtyResize, ei as thresholdShareClaimsSchema, en as TopologyPeers, er as namespacedCapabilitySchema, et as PeerAdvert, f as CapabilityScope, fi as wireCandidateSchema, fn as bulkResumeSchema, fr as procKillSchema, ft as PtySpawn, g as CoordinatorFrame, gn as capabilityGrantSchema, gr as ptyKillSchema, gt as RelayInboundFrame, h as CloseFrame, hn as capabilityGrantOkSchema, hr as protocolVersionSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as tokenClaimsSchema, in as WebrtcIceCandidate, ir as pathTraceOkSchema, it as PrivateUseCapability, j as ExecList, jn as dataHaveFrameSchema, jr as roomMemberSchema, jt as RoomRead, k as DmRoomPath, kn as coseTokenHeadersSchema, kr as roomJoinSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as webrtcAnswerSchema, ln as bulkDataFrameSchema, lr as pongFrameSchema, lt as ProtocolVersion, m as CapabilityVerb, mn as candidatesFrameSchema, mr as procSpawnSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdSignSchema, nn as VersionGet, nr as observedAddressFrameSchema, nt as PingFrame, o as BulkResume, oi as topologyPeersSchema, on as WireCandidate, or as peerAdvertSchema, ot as ProcKill, p as CapabilityToken, pn as candidateKindSchema, pr as procSignalSchema, pt as PtyWrite, q as MessageRef, qn as manageCommandParamsSchema, qr as syncPunchFrameSchema, qt as ThresholdKeygenRound2, r as BulkDataFrame, ri as thresholdSubjectSchema, rn as WebrtcAnswer, rr as ownerNamedRoomPathSchema, rt as PongFrame, s as CandidateKind, si as transferIdSchema, sn as bulkAckFrameSchema, sr as peerIdentitySchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdShareEnvelopeSchema, tn as TransferId, tr as namespacedDomainIdSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as webrtcIceCandidateSchema, un as bulkEndFrameSchema, ur as privateUseCapabilitySchema, ut as PtyKill, v as CoreDomainName, vn as capabilityScopeSchema, vr as ptySpawnSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coreDomainNameSchema, wr as revocationAnnounceFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as closeFrameSchema, xr as relayDataFrameSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityTokenSchema, yr as ptyWriteSchema, yt as RevocationClaims, z as IceCandidateInit, zn as frameSchema, zr as roomSendSchema, zt as StreamEndFrame } from "../protocol-BnbpCk0Z.cjs";
+import { $ as PathTraceOk, $n as messageRefSchema, $r as thresholdKeygenRound2Schema, $t as TopologyGet, A as DomainId, An as dataEntriesFrameSchema, Ar as roomLeaveSchema, At as RoomPath, B as IdentityKey, Bn as frameVariantSchema, Br as sessionIdSchema, Bt as StreamSession, C as CoseTokenHeaders, Cn as coreCapabilitySchema, Cr as relayOfferFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderLabelSchema, Dr as roomInviteSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coseHeaderKidSchema, Er as revocationEntrySchema, Et as RoomMembers, F as GossipFrame, Fn as dmRoomPathSchema, Fr as roomNoticeSchema, Ft as SfuTrackEntry, G as ManageRequestFrame, Gn as iceCandidateInitSchema, Gr as streamEndFrameSchema, Gt as ThresholdKeygenConfirm, H as ManageCommandParams, Hn as handleClaimsSchema, Hr as sfuTrackMapSchema, Ht as ThresholdAbort, I as HandleClaims, In as domainIdSchema, Ir as roomPathSchema, It as SfuTrackMap, J as NamespacedCapability, Jn as manageCommandSchema, Jr as thresholdAbortSchema, Jt as ThresholdShareClaims, K as ManageResponseFrame, Kn as identityKeySchema, Kr as streamSessionSchema, Kt as ThresholdKeygenRound1, L as HandleRecord, Ln as execListSchema, Lr as roomReadSchema, Lt as StreamAckFrame, M as ExecSessionInfo, Mn as dataRequestFrameSchema, Mr as roomMembersOkSchema, Mt as RoomRekey, N as Frame, Nn as deviceIdHexSchema, Nr as roomMembersSchema, Nt as RoomSend, O as DeviceIdHex, On as coseSign1Schema, Or as roomJoinOkSchema, Ot as RoomNotice, P as FrameVariant, Pn as deviceIdSchema, Pr as roomNoticeClaimsSchema, Pt as SessionId, Q as PathTrace, Qn as manageResponseFrameSchema, Qr as thresholdKeygenRound1Schema, Qt as TokenClaims, R as HandshakeFrame, Rn as execSessionInfoSchema, Rr as roomRekeySchema, Rt as StreamDataFrame, S as CoseSign1, Sn as coordinatorFrameSchema, Sr as relayInboundFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coseHeaderAlgSchema, Tr as revocationClaimsSchema, Tt as RoomMember, U as ManageError, Un as handleRecordSchema, Ur as streamAckFrameSchema, Ut as ThresholdCommit, V as ManageCommand, Vn as gossipFrameSchema, Vr as sfuTrackEntrySchema, Vt as SyncPunchFrame, W as ManageOk, Wn as handshakeFrameSchema, Wr as streamDataFrameSchema, Wt as ThresholdCommitment, X as ObservedAddressFrame, Xn as manageOkSchema, Xr as thresholdCommitmentSchema, Xt as ThresholdSign, Y as NamespacedDomainId, Yn as manageErrorSchema, Yr as thresholdCommitSchema, Yt as ThresholdShareEnvelope, Z as OwnerNamedRoomPath, Zn as manageRequestFrameSchema, Zr as thresholdKeygenConfirmSchema, Zt as ThresholdSubject, _ as CoreCapability, _n as capabilityRequestSchema, _r as ptyResizeSchema, _t as RelayOfferFrame, a as BulkOpen, ai as topologyGetSchema, an as WebrtcOffer, ar as pathTraceSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityVerbSchema, br as relayConnectFrameSchema, bt as RevocationEntry, c as CandidatesFrame, ci as versionGetSchema, cn as bulkCancelSchema, cr as pingFrameSchema, ct as ProcSpawn, d as CapabilityRequest, di as webrtcOfferSchema, dn as bulkOpenSchema, dr as privateUseDomainIdSchema, dt as PtyResize, ei as thresholdShareClaimsSchema, en as TopologyPeers, er as namespacedCapabilitySchema, et as PeerAdvert, f as CapabilityScope, fi as wireCandidateSchema, fn as bulkResumeSchema, fr as procKillSchema, ft as PtySpawn, g as CoordinatorFrame, gn as capabilityGrantSchema, gr as ptyKillSchema, gt as RelayInboundFrame, h as CloseFrame, hn as capabilityGrantOkSchema, hr as protocolVersionSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as tokenClaimsSchema, in as WebrtcIceCandidate, ir as pathTraceOkSchema, it as PrivateUseCapability, j as ExecList, jn as dataHaveFrameSchema, jr as roomMemberSchema, jt as RoomRead, k as DmRoomPath, kn as coseTokenHeadersSchema, kr as roomJoinSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as webrtcAnswerSchema, ln as bulkDataFrameSchema, lr as pongFrameSchema, lt as ProtocolVersion, m as CapabilityVerb, mn as candidatesFrameSchema, mr as procSpawnSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdSignSchema, nn as VersionGet, nr as observedAddressFrameSchema, nt as PingFrame, o as BulkResume, oi as topologyPeersSchema, on as WireCandidate, or as peerAdvertSchema, ot as ProcKill, p as CapabilityToken, pn as candidateKindSchema, pr as procSignalSchema, pt as PtyWrite, q as MessageRef, qn as manageCommandParamsSchema, qr as syncPunchFrameSchema, qt as ThresholdKeygenRound2, r as BulkDataFrame, ri as thresholdSubjectSchema, rn as WebrtcAnswer, rr as ownerNamedRoomPathSchema, rt as PongFrame, s as CandidateKind, si as transferIdSchema, sn as bulkAckFrameSchema, sr as peerIdentitySchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdShareEnvelopeSchema, tn as TransferId, tr as namespacedDomainIdSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as webrtcIceCandidateSchema, un as bulkEndFrameSchema, ur as privateUseCapabilitySchema, ut as PtyKill, v as CoreDomainName, vn as capabilityScopeSchema, vr as ptySpawnSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coreDomainNameSchema, wr as revocationAnnounceFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as closeFrameSchema, xr as relayDataFrameSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityTokenSchema, yr as ptyWriteSchema, yt as RevocationClaims, z as IceCandidateInit, zn as frameSchema, zr as roomSendSchema, zt as StreamEndFrame } from "../protocol-Bi2fzBCc.cjs";
 export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PathTrace, PathTraceOk, PeerAdvert, PeerIdentity, PingFrame, PongFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, SessionId, SfuTrackEntry, SfuTrackMap, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, ThresholdAbort, ThresholdCommit, ThresholdCommitment, ThresholdKeygenConfirm, ThresholdKeygenRound1, ThresholdKeygenRound2, ThresholdShareClaims, ThresholdShareEnvelope, ThresholdSign, ThresholdSubject, TokenClaims, TopologyGet, TopologyPeers, TransferId, VersionGet, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, pathTraceOkSchema, pathTraceSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, pongFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, sessionIdSchema, sfuTrackEntrySchema, sfuTrackMapSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, thresholdAbortSchema, thresholdCommitSchema, thresholdCommitmentSchema, thresholdKeygenConfirmSchema, thresholdKeygenRound1Schema, thresholdKeygenRound2Schema, thresholdShareClaimsSchema, thresholdShareEnvelopeSchema, thresholdSignSchema, thresholdSubjectSchema, tokenClaimsSchema, topologyGetSchema, topologyPeersSchema, transferIdSchema, versionGetSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };