@forgesworn/fold-kit 0.10.0 → 0.13.0

package/README.md

@@ -13,10 +13,12 @@ vectors (see EXTRACTION.md). Framework-free: owns no storage, UI, relay
 defaults or identity keys, and no relay I/O of its own - callers inject a
 transport.
 
-**Status:** T1 extraction complete (see EXTRACTION.md). Not yet published to
-npm under this API; pin an immutable Git commit until it is (see Install).
-KithMoot itself has not cut over to this kit yet - it still carries its own
-copy of these modules.
+**Status:** Version 0.13.0 on `main`. Published on npm as
+`@forgesworn/fold-kit`, but `main` can run ahead of the npm `latest` release, so
+compare `npm view @forgesworn/fold-kit version` with this repository's
+`package.json` before relying on an API listed here. KithMoot has cut over to
+this kit and pins an exact npm version; its moved files are re-export shims
+(see EXTRACTION.md).
 
 ## Install
 
@@ -24,14 +26,12 @@ copy of these modules.
 npm install @forgesworn/fold-kit
 ```
 
-Not yet published to npm. Until it is, pin an immutable Git commit:
+To use a change that has not been released, pin an immutable Git commit (a full
+SHA, for example from `git ls-remote https://github.com/forgesworn/fold-kit main`).
+The package's `prepare` script builds `dist/` on install:
 
-```json
-{
-  "dependencies": {
-    "@forgesworn/fold-kit": "github:forgesworn/fold-kit#<commit>"
-  }
-}
+```bash
+npm install "github:forgesworn/fold-kit#<commit>"
 ```
 
 ### Peer dependencies
@@ -46,6 +46,12 @@ Not yet published to npm. Until it is, pin an immutable Git commit:
 }
 ```
 
+Install the peers yourself, keeping `@noble/hashes` on 1.x:
+
+```bash
+npm install "nostr-tools@>=2.24.2 <3" "@noble/hashes@^1.8.0" "@noble/curves@^2.0.1"
+```
+
 Peers, not dependencies, so a consumer such as KithMoot keeps a single copy
 of `nostr-tools` (guarded by its own `overrides` and version-guard test) and
 of the noble libraries, at the same versions KithMoot already pins.
@@ -57,12 +63,69 @@ satisfy this kit's imports as written.
 
 ESM only (`"type": "module"`). Node.js `>=22.13`.
 
+## Quick start
+
+Derive a room, then publish and load a stored group invitation through a
+`RelayTransport` you supply (this one is an in-memory stub; a real transport
+talks to relays and applies the filters):
+
+```ts
+import {
+  generateRoomSecret,
+  deriveRoom,
+  deriveEpoch,
+  localIdentity,
+  createRoomInvitation,
+  encodePersistentInvitation,
+  requestPersistentRoomAdmission,
+  type RelayTransport,
+} from '@forgesworn/fold-kit'
+import { generateSecretKey, type Event } from 'nostr-tools/pure'
+
+// The person: a local signer. An external one (NIP-07, NIP-46) fits the same seam.
+const me = localIdentity(generateSecretKey())
+
+// The room: one secret opens epoch 0; later epochs come from rekeys.
+const roomSecret = generateRoomSecret()
+const { roomId, roomKey } = deriveRoom(roomSecret)
+const epoch0 = deriveEpoch({ epoch: 0, secret: roomSecret }) // { epoch: 0, id: roomId, key: roomKey }
+
+// A RelayTransport stub: stores events, replays them on subscribe, then signals EOSE.
+const stored: Event[] = []
+const transport: RelayTransport = {
+  async publish(event) { stored.push(event) },
+  subscribe(_filters, onEvent, onEose) {
+    queueMicrotask(() => { for (const event of stored) onEvent(event); onEose?.() })
+    return () => {}
+  },
+  close() {},
+}
+
+// Invitation flow (v3 stored group invitation): the inviter publishes once, and a
+// guest holding the link loads it from the relays with no responder online.
+const { invitation, inviterSk } = createRoomInvitation(true)
+await transport.publish(encodePersistentInvitation({
+  invitation, inviterSk, roomSecret, now: Math.floor(Date.now() / 1000),
+}))
+const admission = await requestPersistentRoomAdmission({ transport, invitation })
+// admission.secret is the room secret: deriveRoom(admission.secret).roomId === roomId
+```
+
+Invitation versions: v1 (`encodeJoinUrl`, the room secret in the link) is
+legacy, and new links go through `createRoomInvitation`. Use
+`createRoomInvitation()` for the v2 live rendezvous, which needs a responder
+online (`hostRoomInvitation` answers, `requestRoomAdmissionCapability` joins),
+or `createRoomInvitation(true)` for the v3 stored group invitation above, which
+needs none.
+
 ## Exports
 
-Two entry points: `@forgesworn/fold-kit` (everything) and
+Four entry points: `@forgesworn/fold-kit` (circle primitives),
 `@forgesworn/fold-kit/lane` (just the lane helpers, for a consumer that only
 wants to classify a relay as `public`/`sheltered`/`direct` without pulling in
-the rest).
+the rest), `@forgesworn/fold-kit/mls-admission` (opt-in v4 evidence codec), and
+`@forgesworn/fold-kit/persistent-invitation-evidence` (bounded stored invitation
+observation and independent revalidation).
 
 ### Identity, verification, hex
 
@@ -107,19 +170,54 @@ the rest).
 `hostRoomInvitation` distinguishes approval from grant publication. Its
 `onGrantPublished(request)` and legacy `onAdmitted(device)` callbacks run only
 after the injected transport acknowledges the grant's publication.
-`onGrantFailed(request, error)` reports a rejected or throwing publication;
+`onGrantFailed(request, error)` reports a rejected or throwing publication,
+or approval of a request which has expired;
 neither success callback runs for that failure. Closing or retiring the host
 suppresses callbacks from outstanding sends. Publication acknowledgement does
 not prove that a guest received the grant or joined; the guest validates its
-grant independently. Observer exceptions do not change the publish outcome.
+grant independently. Observer exceptions do not change the publish outcome. Fresh retries of the same
+signed request resend the exact cached grant after the configured quiet delay;
+overlapping approval, wait and publication work is coalesced. Approval and
+success callbacks each occur at most once per request. Failed sends may recover
+on a later retry. The host retains up to 256 live decisions, including declines;
+at capacity it refuses new work until settled requests expire. Close, retirement,
+request freshness and responder authority still gate every send.
+
+For a device that answers automatically, `grantDelayMs: [min, max]` waits a
+random time before each grant, and `coordinate: true` lets several delegated
+devices share one link: each waits (default 500 to 2000 ms) and stands down,
+at most once per request, if another responder's grant to the same
+requester appears. Both are off by default, and the wire format is
+unchanged. See `docs/quiet-replies.md`.
+
+An invitation request's `participant` is an unverified account claim.
+Automatic admission of a previously invited account must use
+`verifiedParticipant`, which is present only after a fresh signature check of
+an account proof bound to this invitation, ephemeral request device and request
+timestamp. `encodeInvitationAccountProof` creates that proof through the
+supplied matching `ParticipantIdentity`. It grants no room access itself and
+stays inside the bearer-encrypted request, rather than being published as a
+public account event. Invalid or missing proofs leave a request unverified;
+hosts can still make an explicit decision for anonymous and older clients.
+
+Pass `identity` to `requestRoomAdmissionCapability` (or `requestRoomAdmission`,
+its secret-only wrapper) to create the proof automatically. If `participant` is also supplied, it must
+match the signer; a signer failure rejects the request without falling back to
+another identity. `signal` cancels signing or waiting. Signing and relay waiting
+share one deadline, capped at the request's 90-second freshness window, and
+late signatures or grants cannot revive a cancelled, expired or retired request.
+Retrying publication uses the same signed request. A fresh human retry starts a
+new exchange. The helper copies a supplied `requesterSk` before signing and
+erases only its owned copy on settlement. Hosts recheck freshness when a human
+decision completes, so approval cannot extend an expired request's authority.
 
 - `parseRoomLink`, `encodeRoomLink`, `RoomLink` - the v1/v2/v3 link envelope
 - `createRoomInvitation`, `roomInvitation`, `deriveInvitationId`,
-  `encodeInvitationRequest`, `decodeInvitationRequest`,
+  `encodeInvitationAccountProof`, `encodeInvitationRequest`, `decodeInvitationRequest`,
   `verifyInvitationDelegation`, `encodeInvitationGrant`,
   `decodeRoomAdmissionGrant`, `encodeInvitationRetirement`,
   `decodeInvitationRetirementNotice`, `hostRoomInvitation`,
-  `requestRoomAdmission` - the v2 live rendezvous invitation, its delegation
+  `requestRoomAdmissionCapability`, `requestRoomAdmission` - the v2 live rendezvous invitation, its delegation
   chain and retirement
 - `encodePersistentInvitation`, `decodePersistentInvitation`,
   `requestPersistentRoomAdmission` - the v3 stored group invitation (1463).
@@ -127,6 +225,23 @@ grant independently. Observer exceptions do not change the publish outcome.
   conference room: the encrypted body carries `ends` and the event a NIP-40
   `expiration` tag, so relays drop it when the room ends; the decoder returns
   `endsAt` and refuses a tag that disagrees with the body
+- From `@forgesworn/fold-kit/persistent-invitation-evidence`,
+  `requestPersistentRoomAdmissionEvidence` and
+  `revalidatePersistentInvitationEvidence` retain and independently recheck a
+  bounded set of canonical signed invitation/retirement carriers, with exact
+  invitation and contributing event IDs. The additive evidence path holds on
+  conflicting newest equal-time relay lists; the legacy request is unchanged.
+  EOSE is local observation metadata, never proof of current membership or
+  global non-retirement. Persist the evidence in protected custody before
+  using its decoded fields. See [the evidence contract](docs/persistent-invitation-evidence.md).
+- The same optional entry exports `revalidatePersistentInvitationSource` for
+  an actual encoder event or its exact canonical retained string. It requires
+  the invitation capability and exact room-root pin, independently verifies
+  the signature and supported body/tags, and returns one canonical carrier
+  plus owned decoded fields. This single source has no EOSE, publication,
+  latest-selection or current-membership claim. Creators retain that event
+  and their publication intent before opening a pool, then retry the same
+  bytes; protected persistence and fresh effect guards belong to the client.
 - Room relays: pass `relays` (one to eight distinct safe relay URLs in
   canonical `normalizeURL` form, e.g. `wss://relay.example.com/`) and the
   encrypted body carries them after `ends`. Every member's pool includes
@@ -161,6 +276,14 @@ grant independently. Observer exceptions do not change the publish outcome.
   catch-up for a device that missed a rekey
 - `hostRoomEpoch`, `requestRoomEpoch`, `EpochRefusedError` - the live
   request/grant desk
+- Quiet replies (`docs/quiet-replies.md`): `hostRoomEpoch` waits a random
+  `replyDelayMs` (default `[500, 2000]`) before any answer, sends a
+  participant a `removed` or `closed` refusal once per `refuseAgainAfter`
+  (default 3600 s) and `unknown` once per `reportUnknownEvery` (60 s), and
+  caps refusals at `maxRefusalsPerMinute` (20). Grants are never limited.
+  `RefusalLimiter`, `replyDelay` and the `DEFAULT_REPLY_DELAY_MS`,
+  `REFUSE_AGAIN_AFTER_SECONDS`, `MAX_REFUSALS_PER_MINUTE` and
+  `REFUSAL_LIMITER_CAPACITY` constants are exported
 - Member epoch catch-up (`docs/member-epoch-catch-up.md`): any current
   member can bring an admitted, non-removed device up to date when the
   authority is offline, and the device checks the answer against the
@@ -187,6 +310,11 @@ grant independently. Observer exceptions do not change the publish outcome.
   `sealSks` on the readers; `credentialFor` on both desks;
   `credentialSeal`, `sealTarget`, `sealTo`, `openSealed`, `newerCredential`,
   `sealCredential`. Vectors: `vectors/seal-vectors.json`
+- One-time senders (`docs/seal-key.md`, "One-time senders"):
+  `oneTimeSender` on `encodeRekeyEvent` and `encodeEpochGrant` seals every
+  copy from a fresh key named in a `from` tag, so a later copy of the
+  authority's key opens no past copy; readers use `sealSender`. Off by
+  default until every client's readers have shipped.
 - Scheduled rekeys and the history window (`docs/scheduled-rekey.md`):
   `encodeRekeyEvent({ scheduled: true })` marks a turn of the key that
   removes nobody, read back as `RekeyNotice.scheduled` and
@@ -290,3 +418,36 @@ admission before publishing, including at epoch zero. No application enables
 this profile automatically. See [the wire profile and integration gates](docs/live-persistent-admission.md).
 Frozen synthetic fixtures are in `vectors/live-persistent-vectors.json`; run
 `npm run build && npm run generate-live-persistent` to regenerate them.
+
+## Authenticated invitation refusal (0.12.0)
+
+`encodeInvitationDecline` and `decodeInvitationDecline` exchange a private,
+request-bound refusal from the pinned inviter or a current delegated responder.
+The version-3 refusal body uses reply kind 20467 and contains no room secret or
+new delegation. Legacy version-2 grant readers ignore it.
+`requestRoomAdmissionCapability` stops retries and rejects with
+`InvitationDeclinedError` after verifying a refusal. Existing host `admit` hooks
+returning false still leave requests unanswered; hosts must explicitly publish
+a refusal using their guarded, acknowledged decision path. No UI integration or
+physical acceptance is claimed by this protocol release.
+
+### MLS admission v4 evidence codec
+
+The separate opt-in v4 codec binds an encrypted account/device request to signed
+keeper consent and an expected MLS group. It uses existing 20466/20467 carriers,
+strict canonical arrays and a fixed payload bucket. Existing room links/codecs
+are unchanged. Import from `@forgesworn/fold-kit/mls-admission`; see [API and boundaries](docs/mls-admission-v4.md).
+
+Exports: `encodeMlsInvitationV4`, `readMlsInvitationV4`,
+`mlsAdmissionProofTemplatesV4`, `encodeMlsAdmissionRequestV4`,
+`decodeMlsAdmissionRequestV4`, `readMlsAdmissionRequestV4`,
+`encodeMlsAdmissionAnswerV4`, `decodeMlsAdmissionAnswerV4`,
+`readMlsAdmissionAnswerV4`, `MLS_ADMISSION_LABELS`,
+`MLS_ADMISSION_PLAINTEXT_BYTES`, `MLS_ADMISSION_CIPHERTEXT_CHARACTERS`;
+types `VerifiedMlsAdmissionRequest` and `VerifiedAdmissionAnswer`.
+
+Verified answers are evidence only. Actual admission requires new purpose-bound
+vault proof and authoritative live box/Link role-witness APIs, a conditional
+keeper revision at the effect boundary, current custody/consent, durable counter
+and one-shot operation storage, and VMLS/Welcome verification. No browser
+admission, authority factory, transport, storage or automatic retry is provided.

package/dist/epoch.d.ts

@@ -2,6 +2,7 @@ import { type Event } from 'nostr-tools/pure';
 import type { RelayTransport } from './transport.js';
 import type { DeviceCredential, KindredProof, RoomPolicy } from './types.js';
 import type { MemberEpochSource } from './member-epoch.js';
+import { type ReplyDelayRange, type ReplySchedule } from './quiet-reply.js';
 /**
  * Room epochs: how a member is removed.
  *
@@ -133,6 +134,13 @@ export interface EncodeRekeyOptions {
     /** A conference room's end, in unix seconds: the event carries it as a
      *  NIP-40 expiration (see `withExpiration`). Omit for a room with no end. */
     expiresAt?: number;
+    /** Seal the copies from a one-time key, named in a `from` tag and
+     *  discarded once they are sealed, instead of from the authority's key.
+     *  Readers from fold-kit 0.13.0 open either; an older reader opens no copy
+     *  from a one-time key, so turn this on only once readers have shipped
+     *  (docs/seal-key.md, "One-time senders"). Omitted, the event is
+     *  byte-identical to before. */
+    oneTimeSender?: boolean;
 }
 /** A rekey recipient: a device, and the newest credential the sender holds
  *  for it. */
@@ -329,6 +337,13 @@ export interface EncodeEpochGrantOptions {
     /** A conference room's end, in unix seconds: the event carries it as a
      *  NIP-40 expiration (see `withExpiration`). Omit for a room with no end. */
     expiresAt?: number;
+    /** Seal the copies from a one-time key, named in a `from` tag and
+     *  discarded once they are sealed, instead of from the authority's key.
+     *  Readers from fold-kit 0.13.0 open either; an older reader opens no copy
+     *  from a one-time key, so turn this on only once readers have shipped
+     *  (docs/seal-key.md, "One-time senders"). Omitted, the event is
+     *  byte-identical to before. */
+    oneTimeSender?: boolean;
 }
 /** Answer one request: the current epoch sealed to the asking device, or a
  *  refusal it alone can read. */
@@ -413,15 +428,34 @@ export interface HostRoomEpochOptions {
      *  is making `known` say yes; the requester's next ask is then granted. */
     onUnknown?: (request: EpochRequest) => void;
     /** Seconds before a participant still unknown and still asking is
-     *  reported again. Default 60. */
+     *  reported again. Default 60. An `unknown` answer goes on the wire at
+     *  the same cadence: a fresh request inside it is reported to nobody and
+     *  answered with silence. */
     reportUnknownEvery?: number;
     policy?: RoomPolicy;
     legacyParticipants?: ReadonlySet<string>;
     now?: () => number;
     onGranted?: (request: EpochRequest) => void;
+    /** Called for every refusal, including one the limits below kept off the
+     *  wire. */
     onRefused?: (request: EpochRequest, why: EpochRefusal) => void;
     /** A conference room's end: every grant carries it as an expiration. */
     expiresAt?: number;
+    /** Seconds before the same participant is sent a `removed` or `closed`
+     *  refusal again. Default 3600 (`REFUSE_AGAIN_AFTER_SECONDS`). A request
+     *  inside it is not answered, so the asker times out instead. */
+    refuseAgainAfter?: number;
+    /** Refusals of any kind published in any 60 seconds, whoever asks.
+     *  Default 20 (`MAX_REFUSALS_PER_MINUTE`). Grants are never limited. */
+    maxRefusalsPerMinute?: number;
+    /** The random wait, in milliseconds, before any answer is published,
+     *  grant or refusal. Default `[500, 2000]` (`DEFAULT_REPLY_DELAY_MS`);
+     *  `[0, 0]` answers at once, as before. */
+    replyDelayMs?: ReplyDelayRange;
+    /** For tests: a source of numbers in [0, 1). Default `Math.random`. */
+    random?: () => number;
+    /** For tests: how the wait is timed. Default `setTimeout`. */
+    schedule?: ReplySchedule;
 }
 /**
  * The credential to seal an answer to: the one the request carries, unless
@@ -448,6 +482,13 @@ export declare function sealCredential(request: {
  * to participants the room knows (`known`), and answers anybody else
  * `unknown` until a member lets them in. A room that has never removed
  * anybody is answered exactly as before.
+ *
+ * Every answer waits a random `replyDelayMs` first, and refusals are
+ * rationed: one a participant per `refuseAgainAfter` (per
+ * `reportUnknownEvery` for `unknown`), and `maxRefusalsPerMinute` in all.
+ * A removed member who still holds the room key can otherwise ask with
+ * fresh requests for ever and time each signed reply, which tells them
+ * when the authority is online. What an answer says is unchanged.
  */
 export declare function hostRoomEpoch(opts: HostRoomEpochOptions): {
     close(): void;

package/dist/epoch.js

@@ -5,16 +5,17 @@ import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';
 import { schnorr } from '@noble/curves/secp256k1.js';
 import { base64urlnopad } from '@scure/base';
 import { nip44 } from 'nostr-tools';
-import { finalizeEvent, getPublicKey } from 'nostr-tools/pure';
+import { finalizeEvent, generateSecretKey, getPublicKey } from 'nostr-tools/pure';
 import { hexEquals, normaliseHex } from './hex.js';
 import { KINDS } from './kinds.js';
 import { deriveRoom } from './room.js';
 import { verifyDeviceCredential } from './credential.js';
 import { evaluateAccess } from './access.js';
 import { verifyEventUncached } from './verify.js';
-import { newerCredential, openSealed, sealTo } from './seal.js';
+import { SENDER_TAG, newerCredential, openSealed, sealSender, sealTo } from './seal.js';
 import { withExpiration } from './expiration.js';
 import { epochCommitment } from './epoch-commit.js';
+import { DEFAULT_REPLY_DELAY_MS, REFUSE_AGAIN_AFTER_SECONDS, RefusalLimiter, defaultReplySchedule, replyDelay } from './quiet-reply.js';
 /**
  * Room epochs: how a member is removed.
  *
@@ -134,6 +135,14 @@ function memberListOf(members, removed) {
         out.delete(normaliseHex(p));
     return [...out].sort();
 }
+/** The key a rekey or grant seals from: the authority's own, or, with
+ *  `oneTimeSender`, a fresh one named in a `from` tag and zeroed once used. */
+function oneTimeSenderOf(opts) {
+    if (!opts.oneTimeSender)
+        return { sk: opts.authoritySk, tags: [], discard: () => { } };
+    const sk = generateSecretKey();
+    return { sk, tags: [[SENDER_TAG, getPublicKey(sk)]], discard: () => sk.fill(0) };
+}
 /** Announce the next epoch. See the module comment for what this is. */
 export function encodeRekeyEvent(opts) {
     require32(opts.authoritySk, 'authority secret key');
@@ -150,10 +159,16 @@ export function encodeRekeyEvent(opts) {
     const keys = {};
     const sealed = { v: 1, secret: base64urlnopad.encode(opts.next.secret) };
     const plaintext = JSON.stringify(sealed);
-    for (const raw of opts.closed ? [] : opts.recipients) {
-        const recipient = typeof raw === 'string' ? { device: raw } : raw;
-        const device = requireHex32(recipient.device, 'recipient device');
-        keys[device] = sealTo(plaintext, opts.authoritySk, device, recipient.credential);
+    const sender = oneTimeSenderOf(opts);
+    try {
+        for (const raw of opts.closed ? [] : opts.recipients) {
+            const recipient = typeof raw === 'string' ? { device: raw } : raw;
+            const device = requireHex32(recipient.device, 'recipient device');
+            keys[device] = sealTo(plaintext, sender.sk, device, recipient.credential);
+        }
+    }
+    finally {
+        sender.discard();
     }
     const body = {
         v: 1,
@@ -173,6 +188,7 @@ export function encodeRekeyEvent(opts) {
         tags: withExpiration([
             ['d', roomId],
             ['epoch', String(epoch)],
+            ...sender.tags,
         ], opts.expiresAt),
         content: nip44.v2.encrypt(JSON.stringify(body), opts.current.key),
     }, opts.authoritySk);
@@ -238,13 +254,14 @@ export function decodeRekeyEvent(event, opts) {
             notice.members = members;
         const device = getPublicKey(opts.deviceSk);
         const mine = Object.entries(body.keys).find(([to]) => hexEquals(to, device))?.[1];
-        if (typeof mine === 'string') {
+        const sender = sealSender(event);
+        if (typeof mine === 'string' && sender !== null) {
             // A copy none of this device's keys opens is no copy: sealed to a
             // seal key it has since erased, or one it never had. The rest of the
             // rekey still says who was removed, so it is read without the secret,
             // and the device asks for the epoch.
             try {
-                const sealed = JSON.parse(openSealed(mine, event.pubkey, opts.deviceSk, opts.sealSks));
+                const sealed = JSON.parse(openSealed(mine, sender, opts.deviceSk, opts.sealSks));
                 if (sealed.v === 1 && typeof sealed.secret === 'string') {
                     const secret = base64urlnopad.decode(sealed.secret);
                     if (secret.length === 32)
@@ -505,14 +522,23 @@ export function encodeEpochGrant(opts) {
         if (opts.passed !== undefined && opts.passed.length > 0)
             body.passed = passedListOf(opts.passed, body.epoch);
     }
+    const sender = oneTimeSenderOf(opts);
+    let content;
+    try {
+        content = sealTo(JSON.stringify(body), sender.sk, device, opts.credential);
+    }
+    finally {
+        sender.discard();
+    }
     return finalizeEvent({
         kind: KINDS.EPOCH_GRANT,
         created_at: opts.now,
         tags: withExpiration([
             ['d', roomId],
             ['p', device],
+            ...sender.tags,
         ], opts.expiresAt),
-        content: sealTo(JSON.stringify(body), opts.authoritySk, device, opts.credential),
+        content,
     }, opts.authoritySk);
 }
 /** Read the authority's answer to this device's own request. Null for
@@ -534,7 +560,10 @@ export function decodeEpochGrant(event, opts) {
         const addressed = event.tags.find((t) => t[0] === 'p')?.[1];
         if (addressed === undefined || !hexEquals(addressed, device))
             return null;
-        const body = JSON.parse(openSealed(event.content, event.pubkey, opts.deviceSk, opts.sealSks));
+        const sender = sealSender(event);
+        if (sender === null)
+            return null;
+        const body = JSON.parse(openSealed(event.content, sender, opts.deviceSk, opts.sealSks));
         if (body.v !== 1 || typeof body.request !== 'string' || !hexEquals(body.request, opts.request))
             return null;
         if (body.refused === 'removed' || body.refused === 'closed' || body.refused === 'unknown')
@@ -622,6 +651,13 @@ export function sealCredential(request, presented, credentialFor, roomId, now) {
  * to participants the room knows (`known`), and answers anybody else
  * `unknown` until a member lets them in. A room that has never removed
  * anybody is answered exactly as before.
+ *
+ * Every answer waits a random `replyDelayMs` first, and refusals are
+ * rationed: one a participant per `refuseAgainAfter` (per
+ * `reportUnknownEvery` for `unknown`), and `maxRefusalsPerMinute` in all.
+ * A removed member who still holds the room key can otherwise ask with
+ * fresh requests for ever and time each signed reply, which tells them
+ * when the authority is online. What an answer says is unchanged.
  */
 export function hostRoomEpoch(opts) {
     require32(opts.authoritySk, 'authority secret key');
@@ -640,6 +676,13 @@ export function hostRoomEpoch(opts) {
         if (set.size > 256)
             set.delete(set.values().next().value);
     };
+    const refusals = new RefusalLimiter({ perMinute: opts.maxRefusalsPerMinute });
+    const delayRange = opts.replyDelayMs ?? DEFAULT_REPLY_DELAY_MS;
+    const random = opts.random ?? Math.random;
+    const schedule = opts.schedule ?? defaultReplySchedule;
+    /** Requests waiting out their delay, each with how to cancel it. Bounded:
+     *  a request turned away while it is full is answered on its retry. */
+    const pending = new Map();
     let closed = false;
     const unsub = opts.transport.subscribe([{ kinds: [KINDS.EPOCH_REQUEST], '#d': [roomId], '#p': [authority] }], (event) => {
         if (closed)
@@ -652,80 +695,104 @@ export function hostRoomEpoch(opts) {
             policy: opts.policy,
             legacyParticipants: opts.legacyParticipants,
         });
-        if (!read || answered.has(read.request.request))
+        if (!read || answered.has(read.request.request) || pending.has(read.request.request))
             return;
         const request = read.request;
-        let refused;
-        if (opts.closed?.())
-            refused = 'closed';
-        else if (opts.removed().has(request.participant))
-            refused = 'removed';
-        else if (opts.removed().size > 0 && !opts.known?.(request.participant))
-            refused = 'unknown';
-        if (refused === 'unknown') {
-            if (waiting.has(request.request))
+        const reply = () => {
+            pending.delete(request.request);
+            if (closed)
                 return;
-            waiting.add(request.request);
-            bound(waiting);
-        }
-        else {
-            waiting.delete(request.request);
-            answered.add(request.request);
-            bound(answered);
-        }
-        let grant;
-        try {
-            if (refused) {
-                grant = encodeEpochGrant({
-                    roomId,
-                    authoritySk: opts.authoritySk,
-                    device: request.device,
-                    request: request.request,
-                    now: now(),
-                    refused,
-                    credential: sealCredential(request, read.credential, opts.credentialFor, roomId, now()),
-                    expiresAt: opts.expiresAt,
-                });
+            let refused;
+            if (opts.closed?.())
+                refused = 'closed';
+            else if (opts.removed().has(request.participant))
+                refused = 'removed';
+            else if (opts.removed().size > 0 && !opts.known?.(request.participant))
+                refused = 'unknown';
+            if (refused === 'unknown') {
+                if (waiting.has(request.request))
+                    return;
+                waiting.add(request.request);
+                bound(waiting);
             }
             else {
-                const epoch = opts.current();
-                grant = encodeEpochGrant({
-                    roomId,
-                    authoritySk: opts.authoritySk,
-                    device: request.device,
-                    request: request.request,
-                    now: now(),
-                    epoch,
-                    removed: [...opts.removed()],
-                    ...(opts.members ? { members: [...opts.members()] } : {}),
-                    ...(opts.past ? { passed: passedFor(opts.past, epoch.epoch, now()) } : {}),
-                    credential: sealCredential(request, read.credential, opts.credentialFor, roomId, now()),
-                    expiresAt: opts.expiresAt,
-                });
+                waiting.delete(request.request);
+                answered.add(request.request);
+                bound(answered);
             }
-        }
-        catch {
+            const quiet = refused !== undefined && !refusals.allow(request.participant, refused === 'unknown' ? (opts.reportUnknownEvery ?? REPORT_UNKNOWN_EVERY_SECONDS) : (opts.refuseAgainAfter ?? REFUSE_AGAIN_AFTER_SECONDS), now());
+            if (!quiet) {
+                let grant;
+                try {
+                    if (refused) {
+                        grant = encodeEpochGrant({
+                            roomId,
+                            authoritySk: opts.authoritySk,
+                            device: request.device,
+                            request: request.request,
+                            now: now(),
+                            refused,
+                            credential: sealCredential(request, read.credential, opts.credentialFor, roomId, now()),
+                            expiresAt: opts.expiresAt,
+                        });
+                    }
+                    else {
+                        const epoch = opts.current();
+                        grant = encodeEpochGrant({
+                            roomId,
+                            authoritySk: opts.authoritySk,
+                            device: request.device,
+                            request: request.request,
+                            now: now(),
+                            epoch,
+                            removed: [...opts.removed()],
+                            ...(opts.members ? { members: [...opts.members()] } : {}),
+                            ...(opts.past ? { passed: passedFor(opts.past, epoch.epoch, now()) } : {}),
+                            credential: sealCredential(request, read.credential, opts.credentialFor, roomId, now()),
+                            expiresAt: opts.expiresAt,
+                        });
+                    }
+                }
+                catch {
+                    return;
+                }
+                opts.transport.publish(grant).catch(() => { });
+            }
+            if (refused === 'unknown' && now() - (reported.get(request.participant) ?? -Infinity) >= (opts.reportUnknownEvery ?? REPORT_UNKNOWN_EVERY_SECONDS)) {
+                reported.set(request.participant, now());
+                if (reported.size > 256)
+                    reported.delete(reported.keys().next().value);
+                opts.onUnknown?.(request);
+            }
+            if (!refused)
+                reported.delete(request.participant);
+            if (!refused)
+                refusals.forget(request.participant);
+            if (refused)
+                opts.onRefused?.(request, refused);
+            else
+                opts.onGranted?.(request);
+        };
+        const delay = replyDelay(delayRange, random);
+        if (delay === 0) {
+            reply();
             return;
         }
-        opts.transport.publish(grant).catch(() => { });
-        if (refused === 'unknown' && now() - (reported.get(request.participant) ?? -Infinity) >= (opts.reportUnknownEvery ?? REPORT_UNKNOWN_EVERY_SECONDS)) {
-            reported.set(request.participant, now());
-            if (reported.size > 256)
-                reported.delete(reported.keys().next().value);
-            opts.onUnknown?.(request);
-        }
-        if (!refused)
-            reported.delete(request.participant);
-        if (refused)
-            opts.onRefused?.(request, refused);
-        else
-            opts.onGranted?.(request);
+        if (pending.size >= 256)
+            return;
+        pending.set(request.request, () => { });
+        const cancel = schedule(reply, delay);
+        if (pending.has(request.request))
+            pending.set(request.request, cancel);
     });
     return {
         close() {
             if (closed)
                 return;
             closed = true;
+            for (const cancel of pending.values())
+                cancel();
+            pending.clear();
             unsub();
         },
     };