diff --ignore-trailing-space '--exclude=package.json' '--exclude=README.md' '--exclude=CHANGELOG.md' '--unified=3' webref/node_modules/@webref/idl/fedcm.idl packages/idl/fedcm.idl
--- webref/node_modules/@webref/idl/fedcm.idl
+++ packages/idl/fedcm.idl
@@ -120,6 +120,7 @@
 dictionary IdentityProviderClientMetadata {
   USVString privacy_policy_url;
   USVString terms_of_service_url;
+  boolean client_is_third_party_to_top_frame_origin = false;
 };
 
 dictionary IdentityUserInfo {

diff --ignore-trailing-space '--exclude=package.json' '--exclude=README.md' '--exclude=CHANGELOG.md' '--unified=3' webref/node_modules/@webref/idl/webrtc-encoded-transform.idl packages/idl/webrtc-encoded-transform.idl
--- webref/node_modules/@webref/idl/webrtc-encoded-transform.idl
+++ packages/idl/webrtc-encoded-transform.idl
@@ -14,11 +14,6 @@
     attribute RTCRtpTransform? transform;
 };
 
-enum SFrameTransformRole {
-    "encrypt",
-    "decrypt"
-};
-
 // List of supported cipher suites, as defined in [[RFC9605]] section 4.5.
 enum SFrameCipherSuite {
      "AES_128_CTR_HMAC_SHA256_80",
@@ -29,20 +24,36 @@
 };
 
 dictionary SFrameTransformOptions {
-    SFrameTransformRole role = "encrypt";
     required SFrameCipherSuite cipherSuite;
 };
 
 typedef [EnforceRange] unsigned long long SmallCryptoKeyID;
 typedef (SmallCryptoKeyID or bigint) CryptoKeyID;
 
-[Exposed=(Window,DedicatedWorker)]
-interface SFrameTransform : EventTarget {
-    constructor(optional SFrameTransformOptions options = {});
+interface mixin SFrameKeyManagement {
     Promise<undefined> setEncryptionKey(CryptoKey key, optional CryptoKeyID keyID);
     attribute EventHandler onerror;
 };
-SFrameTransform includes GenericTransformStream;
+
+[Exposed=Window]
+interface SFrameTransform : EventTarget {
+    constructor(optional SFrameTransformOptions options = {});
+};
+SFrameTransform includes SFrameKeyManagement;
+
+[Exposed=(Window,DedicatedWorker)]
+interface SFrameEncrypterStream : EventTarget {
+    constructor(optional SFrameTransformOptions options = {});
+};
+SFrameEncrypterStream includes GenericTransformStream;
+SFrameEncrypterStream includes SFrameKeyManagement;
+
+[Exposed=(Window,DedicatedWorker)]
+interface SFrameDecrypterStream : EventTarget {
+    constructor(optional SFrameTransformOptions options = {});
+};
+SFrameDecrypterStream includes GenericTransformStream;
+SFrameDecrypterStream includes SFrameKeyManagement;
 
 enum SFrameTransformErrorEventType {
     "authentication",