wire-mesh-core 3.7.1 → 3.8.0

package/dist/domain/hub-mailbox.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {

package/dist/domain/hub-mailbox.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {

package/dist/domain/mesh-session.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
+const require_domain_device_id = require("./device-id.cjs");
 const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
 const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
 const require_domain_async_queue = require("./async-queue.cjs");
-const require_domain_device_id = require("./device-id.cjs");
 const require_domain_handshake = require("./handshake.cjs");
 const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
 const require_domain_topology_snapshot = require("./topology-snapshot.cjs");

package/dist/domain/mesh-session.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
-import { r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
+import { r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */

package/dist/domain/mesh-session.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
-import { r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
+import { r as Transport, t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */

package/dist/domain/mesh-session.mjs

@@ -1,9 +1,9 @@
 import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
+import { deviceIdToHex } from "./device-id.mjs";
 import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
 import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
 import { createAsyncQueue } from "./async-queue.mjs";
-import { deviceIdToHex } from "./device-id.mjs";
 import { negotiate } from "./handshake.mjs";
 import { createPingRoundTrips } from "./ping-round-trips.mjs";
 import { createTopologySnapshotTracker } from "./topology-snapshot.mjs";

package/dist/domain/notice-board.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
+import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/notice-board.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
+import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/path-trace.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/path-trace.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/relay-advert.d.cts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
+import { et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
 //#region src/domain/relay-advert.d.ts
 /** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
 export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";

package/dist/domain/relay-advert.d.mts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
+import { et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
 //#region src/domain/relay-advert.d.ts
 /** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
 export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-DIXjoQKn.cjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { t as Connection } from "../transport-DP3hdehk.cjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.cjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.cjs";
 import { PeerAdvertVerifier } from "./peer-advert.cjs";

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-B0GywEzG.mjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { t as Connection } from "../transport-Dv_LTCsF.mjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.mjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.mjs";
 import { PeerAdvertVerifier } from "./peer-advert.mjs";

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-DIXjoQKn.cjs";
+import { N as Frame } from "../protocol-BgR1e_NI.cjs";
+import { t as Connection } from "../transport-DP3hdehk.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-B0GywEzG.mjs";
+import { N as Frame } from "../protocol-BgR1e_NI.mjs";
+import { t as Connection } from "../transport-Dv_LTCsF.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-DCDae3z4.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DqFu7iMX.cjs";
+import { bt as RevocationEntry } from "../protocol-BgR1e_NI.cjs";
+import { f as VerifyRevocationEntryOptions, o as RevocationCheck, s as RevocationEntryVerdict } from "../tokens-BMWCnQEF.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-DCDae3z4.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CBiSYuzp.mjs";
+import { bt as RevocationEntry } from "../protocol-BgR1e_NI.mjs";
+import { f as VerifyRevocationEntryOptions, o as RevocationCheck, s as RevocationEntryVerdict } from "../tokens-DRkm_QOR.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
-import { o as verifyRevocationEntry } from "../tokens-CMdWiRBb.mjs";
 import { bytesToHex } from "./device-id.mjs";
+import { c as verifyRevocationEntry } from "../tokens-D8JlTJNA.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-rekey.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
+import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-rekey.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
+import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room-token-verification.d.cts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-PSv4eQ1x.cjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-hFtBDZPO.cjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.d.mts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CkGnFuQc.mjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-7zD4ib-A.mjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
-import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
+import { s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room.d.cts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DCDae3z4.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BgR1e_NI.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-PSv4eQ1x.cjs";
+import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-hFtBDZPO.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/room.d.mts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BgR1e_NI.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-CkGnFuQc.mjs";
+import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-7zD4ib-A.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/shard-manifest.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.cjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/shard-manifest.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.mjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/threshold-subject.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
+const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.

package/dist/domain/threshold-subject.mjs

@@ -1,4 +1,4 @@
-import { i as sig1ToBeSigned } from "../tokens-CMdWiRBb.mjs";
+import { o as sig1ToBeSigned } from "../tokens-D8JlTJNA.mjs";
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.

package/dist/domain/tokens.cjs

@@ -1,6 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
+const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+exports.MANAGE_GRANT_CAPABILITY = require_tokens.MANAGE_GRANT_CAPABILITY;
 exports.canGrant = require_tokens.canGrant;
+exports.canGrantVia = require_tokens.canGrantVia;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;
 exports.sig1ToBeSigned = require_tokens.sig1ToBeSigned;

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-DqFu7iMX.cjs";
-export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };
+import { _ as sig1ToBeSigned, a as MintVerdict, c as RevocationEntryVerdictReason, d as VerifyCapabilityTokenOptions, f as VerifyRevocationEntryOptions, g as mintRevocationEntry, h as mintCapabilityToken, i as MintRevocationEntryOptions, l as TokenVerdict, m as canGrantVia, n as MintCapabilityTokenOptions, o as RevocationCheck, p as canGrant, r as MintRefusalReason, s as RevocationEntryVerdict, t as MANAGE_GRANT_CAPABILITY, u as TokenVerdictReason, v as verifyCapabilityToken, y as verifyRevocationEntry } from "../tokens-BMWCnQEF.cjs";
+export { MANAGE_GRANT_CAPABILITY, MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, canGrantVia, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CBiSYuzp.mjs";
-export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };
+import { _ as sig1ToBeSigned, a as MintVerdict, c as RevocationEntryVerdictReason, d as VerifyCapabilityTokenOptions, f as VerifyRevocationEntryOptions, g as mintRevocationEntry, h as mintCapabilityToken, i as MintRevocationEntryOptions, l as TokenVerdict, m as canGrantVia, n as MintCapabilityTokenOptions, o as RevocationCheck, p as canGrant, r as MintRefusalReason, s as RevocationEntryVerdict, t as MANAGE_GRANT_CAPABILITY, u as TokenVerdictReason, v as verifyCapabilityToken, y as verifyRevocationEntry } from "../tokens-DRkm_QOR.mjs";
+export { MANAGE_GRANT_CAPABILITY, MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, canGrantVia, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyCapabilityToken, i as sig1ToBeSigned, n as mintCapabilityToken, o as verifyRevocationEntry, r as mintRevocationEntry, t as canGrant } from "../tokens-CMdWiRBb.mjs";
-export { canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };
+import { a as mintRevocationEntry, c as verifyRevocationEntry, i as mintCapabilityToken, n as canGrant, o as sig1ToBeSigned, r as canGrantVia, s as verifyCapabilityToken, t as MANAGE_GRANT_CAPABILITY } from "../tokens-D8JlTJNA.mjs";
+export { MANAGE_GRANT_CAPABILITY, canGrant, canGrantVia, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/topology-snapshot.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, nn as TopologyPeers } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, nn as TopologyPeers } from "../protocol-BgR1e_NI.cjs";
 //#region src/domain/topology-snapshot.d.ts
 export interface TopologyPeersInputs {
   /** connection?.peerDeviceId -- the transport-authenticated direct peer, when the adapter gives one. Takes priority over firstAdvertisedPeer below. */

package/dist/domain/topology-snapshot.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, nn as TopologyPeers } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, nn as TopologyPeers } from "../protocol-BgR1e_NI.mjs";
 //#region src/domain/topology-snapshot.d.ts
 export interface TopologyPeersInputs {
   /** connection?.peerDeviceId -- the transport-authenticated direct peer, when the adapter gives one. Takes priority over firstAdvertisedPeer below. */

package/dist/domain/topology.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, V as ManageCommand, et as PeerAdvert, nn as TopologyPeers } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, V as ManageCommand, et as PeerAdvert, nn as TopologyPeers } from "../protocol-BgR1e_NI.cjs";
 import { DirectoryEntry, IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/topology.d.ts
 export declare const TOPOLOGY_GET_CAPABILITY = "topology:get";

package/dist/domain/topology.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, V as ManageCommand, et as PeerAdvert, nn as TopologyPeers } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, V as ManageCommand, et as PeerAdvert, nn as TopologyPeers } from "../protocol-BgR1e_NI.mjs";
 import { DirectoryEntry, IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/topology.d.ts
 export declare const TOPOLOGY_GET_CAPABILITY = "topology:get";

package/dist/domain/webrtc-signaling.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
+const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.d.cts

@@ -1,6 +1,6 @@
-import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-DCDae3z4.cjs";
+import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-BgR1e_NI.cjs";
 import { IncomingManageRequest } from "./mesh-session.cjs";
-import { u as VerifyCapabilityTokenOptions } from "../tokens-DqFu7iMX.cjs";
+import { d as VerifyCapabilityTokenOptions } from "../tokens-BMWCnQEF.cjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.d.mts

@@ -1,6 +1,6 @@
-import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-DCDae3z4.mjs";
+import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-BgR1e_NI.mjs";
 import { IncomingManageRequest } from "./mesh-session.mjs";
-import { u as VerifyCapabilityTokenOptions } from "../tokens-CBiSYuzp.mjs";
+import { d as VerifyCapabilityTokenOptions } from "../tokens-DRkm_QOR.mjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.mjs

@@ -1,4 +1,4 @@
-import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
+import { s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/generated/protocol.cjs

@@ -469,9 +469,12 @@ const tokenClaimsSchema = zod.z.lazy(() => zod.z.object({
 	"expires": zod.z.number().int().nonnegative(),
 	"not-before": zod.z.number().int().nonnegative().optional(),
 	"parent": zod.z.instanceof(Uint8Array).optional(),
+	"authorised-by": zod.z.instanceof(Uint8Array).optional(),
 	"delegations-remaining": zod.z.number().int().nonnegative().optional(),
 	"valid-until": zod.z.number().int().nonnegative().optional(),
-	"conditions": zod.z.instanceof(Uint8Array).optional()
+	"conditions": zod.z.instanceof(Uint8Array).optional(),
+	"grants-capability": zod.z.lazy(() => capabilityVerbSchema).optional(),
+	"requests-capability": zod.z.lazy(() => capabilityVerbSchema).optional()
 }).catchall(zod.z.unknown()));
 const pingFrameSchema = zod.z.lazy(() => zod.z.object({ "type": zod.z.literal("ping") }));
 const pongFrameSchema = zod.z.lazy(() => zod.z.object({ "type": zod.z.literal("pong") }));

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-DCDae3z4.cjs";
+import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-BgR1e_NI.cjs";
 export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PathTrace, PathTraceOk, PeerAdvert, PeerIdentity, PingFrame, PongFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, SecureDataFrame, SecureHelloFrame, SessionId, SfuTrackEntry, SfuTrackMap, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, ThresholdAbort, ThresholdCommit, ThresholdCommitment, ThresholdKeygenConfirm, ThresholdKeygenRound1, ThresholdKeygenRound2, ThresholdShareClaims, ThresholdShareEnvelope, ThresholdSign, ThresholdSubject, TokenClaims, TopologyGet, TopologyPeers, TransferId, VersionGet, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, pathTraceOkSchema, pathTraceSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, pongFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, secureDataFrameSchema, secureHelloFrameSchema, sessionIdSchema, sfuTrackEntrySchema, sfuTrackMapSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, thresholdAbortSchema, thresholdCommitSchema, thresholdCommitmentSchema, thresholdKeygenConfirmSchema, thresholdKeygenRound1Schema, thresholdKeygenRound2Schema, thresholdShareClaimsSchema, thresholdShareEnvelopeSchema, thresholdSignSchema, thresholdSubjectSchema, tokenClaimsSchema, topologyGetSchema, topologyPeersSchema, transferIdSchema, versionGetSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.d.mts

@@ -1,2 +1,2 @@
-import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-DCDae3z4.mjs";
+import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-BgR1e_NI.mjs";
 export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PathTrace, PathTraceOk, PeerAdvert, PeerIdentity, PingFrame, PongFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, SecureDataFrame, SecureHelloFrame, SessionId, SfuTrackEntry, SfuTrackMap, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, ThresholdAbort, ThresholdCommit, ThresholdCommitment, ThresholdKeygenConfirm, ThresholdKeygenRound1, ThresholdKeygenRound2, ThresholdShareClaims, ThresholdShareEnvelope, ThresholdSign, ThresholdSubject, TokenClaims, TopologyGet, TopologyPeers, TransferId, VersionGet, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, pathTraceOkSchema, pathTraceSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, pongFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, secureDataFrameSchema, secureHelloFrameSchema, sessionIdSchema, sfuTrackEntrySchema, sfuTrackMapSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, thresholdAbortSchema, thresholdCommitSchema, thresholdCommitmentSchema, thresholdKeygenConfirmSchema, thresholdKeygenRound1Schema, thresholdKeygenRound2Schema, thresholdShareClaimsSchema, thresholdShareEnvelopeSchema, thresholdSignSchema, thresholdSubjectSchema, tokenClaimsSchema, topologyGetSchema, topologyPeersSchema, transferIdSchema, versionGetSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.mjs

@@ -468,9 +468,12 @@ const tokenClaimsSchema = z.lazy(() => z.object({
 	"expires": z.number().int().nonnegative(),
 	"not-before": z.number().int().nonnegative().optional(),
 	"parent": z.instanceof(Uint8Array).optional(),
+	"authorised-by": z.instanceof(Uint8Array).optional(),
 	"delegations-remaining": z.number().int().nonnegative().optional(),
 	"valid-until": z.number().int().nonnegative().optional(),
-	"conditions": z.instanceof(Uint8Array).optional()
+	"conditions": z.instanceof(Uint8Array).optional(),
+	"grants-capability": z.lazy(() => capabilityVerbSchema).optional(),
+	"requests-capability": z.lazy(() => capabilityVerbSchema).optional()
 }).catchall(z.unknown()));
 const pingFrameSchema = z.lazy(() => z.object({ "type": z.literal("ping") }));
 const pongFrameSchema = z.lazy(() => z.object({ "type": z.literal("pong") }));

package/dist/{identity-DVCNuFLG.d.cts → identity-DJbr96J3.d.cts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-DCDae3z4.cjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-BgR1e_NI.cjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/{identity-DcaYgjXT.d.mts → identity-ViYdZrIU.d.mts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-DCDae3z4.mjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-BgR1e_NI.mjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 export { IdentityPort };

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
 export { Connection, Listener, Transport };