@forgesworn/fold-kit 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ This kit is pre-1.0 (see AGENTS.md "Release Notes"); a behaviour change on
 byte-identical copy of a KithMoot function (see EXTRACTION.md) and this is
 the one place its behaviour has deliberately diverged.
 
+## 0.13.0
+
+### Added
+
+- One-time senders for rekeys (1462) and authority grants (20469):
+  `oneTimeSender` on `encodeRekeyEvent` and `encodeEpochGrant` seals every
+  copy from a fresh key named in a `from` tag, so a later copy of the
+  authority's key no longer opens past copies. Off by default; off, events
+  are byte-identical to 0.12.0. Readers (`decodeRekeyEvent`,
+  `decodeEpochGrant`) open either form now, through the new `sealSender`
+  (also exported, with `SENDER_TAG`). Turn writers on only once these readers
+  have shipped everywhere. See docs/seal-key.md, "One-time senders"; vectors
+  in `seal-vectors.json`.
+
 ## 0.12.0
 
 ### Fixed

package/README.md

@@ -13,7 +13,7 @@ vectors (see EXTRACTION.md). Framework-free: owns no storage, UI, relay
 defaults or identity keys, and no relay I/O of its own - callers inject a
 transport.
 
-**Status:** Version 0.12.0 on `main`. Published on npm as
+**Status:** Version 0.13.0 on `main`. Published on npm as
 `@forgesworn/fold-kit`, but `main` can run ahead of the npm `latest` release, so
 compare `npm view @forgesworn/fold-kit version` with this repository's
 `package.json` before relying on an API listed here. KithMoot has cut over to
@@ -310,6 +310,11 @@ decision completes, so approval cannot extend an expired request's authority.
   `sealSks` on the readers; `credentialFor` on both desks;
   `credentialSeal`, `sealTarget`, `sealTo`, `openSealed`, `newerCredential`,
   `sealCredential`. Vectors: `vectors/seal-vectors.json`
+- One-time senders (`docs/seal-key.md`, "One-time senders"):
+  `oneTimeSender` on `encodeRekeyEvent` and `encodeEpochGrant` seals every
+  copy from a fresh key named in a `from` tag, so a later copy of the
+  authority's key opens no past copy; readers use `sealSender`. Off by
+  default until every client's readers have shipped.
 - Scheduled rekeys and the history window (`docs/scheduled-rekey.md`):
   `encodeRekeyEvent({ scheduled: true })` marks a turn of the key that
   removes nobody, read back as `RekeyNotice.scheduled` and

package/dist/epoch.d.ts

@@ -134,6 +134,13 @@ export interface EncodeRekeyOptions {
     /** A conference room's end, in unix seconds: the event carries it as a
      *  NIP-40 expiration (see `withExpiration`). Omit for a room with no end. */
     expiresAt?: number;
+    /** Seal the copies from a one-time key, named in a `from` tag and
+     *  discarded once they are sealed, instead of from the authority's key.
+     *  Readers from fold-kit 0.13.0 open either; an older reader opens no copy
+     *  from a one-time key, so turn this on only once readers have shipped
+     *  (docs/seal-key.md, "One-time senders"). Omitted, the event is
+     *  byte-identical to before. */
+    oneTimeSender?: boolean;
 }
 /** A rekey recipient: a device, and the newest credential the sender holds
  *  for it. */
@@ -330,6 +337,13 @@ export interface EncodeEpochGrantOptions {
     /** A conference room's end, in unix seconds: the event carries it as a
      *  NIP-40 expiration (see `withExpiration`). Omit for a room with no end. */
     expiresAt?: number;
+    /** Seal the copies from a one-time key, named in a `from` tag and
+     *  discarded once they are sealed, instead of from the authority's key.
+     *  Readers from fold-kit 0.13.0 open either; an older reader opens no copy
+     *  from a one-time key, so turn this on only once readers have shipped
+     *  (docs/seal-key.md, "One-time senders"). Omitted, the event is
+     *  byte-identical to before. */
+    oneTimeSender?: boolean;
 }
 /** Answer one request: the current epoch sealed to the asking device, or a
  *  refusal it alone can read. */

package/dist/epoch.js

@@ -5,14 +5,14 @@ import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';
 import { schnorr } from '@noble/curves/secp256k1.js';
 import { base64urlnopad } from '@scure/base';
 import { nip44 } from 'nostr-tools';
-import { finalizeEvent, getPublicKey } from 'nostr-tools/pure';
+import { finalizeEvent, generateSecretKey, getPublicKey } from 'nostr-tools/pure';
 import { hexEquals, normaliseHex } from './hex.js';
 import { KINDS } from './kinds.js';
 import { deriveRoom } from './room.js';
 import { verifyDeviceCredential } from './credential.js';
 import { evaluateAccess } from './access.js';
 import { verifyEventUncached } from './verify.js';
-import { newerCredential, openSealed, sealTo } from './seal.js';
+import { SENDER_TAG, newerCredential, openSealed, sealSender, sealTo } from './seal.js';
 import { withExpiration } from './expiration.js';
 import { epochCommitment } from './epoch-commit.js';
 import { DEFAULT_REPLY_DELAY_MS, REFUSE_AGAIN_AFTER_SECONDS, RefusalLimiter, defaultReplySchedule, replyDelay } from './quiet-reply.js';
@@ -135,6 +135,14 @@ function memberListOf(members, removed) {
         out.delete(normaliseHex(p));
     return [...out].sort();
 }
+/** The key a rekey or grant seals from: the authority's own, or, with
+ *  `oneTimeSender`, a fresh one named in a `from` tag and zeroed once used. */
+function oneTimeSenderOf(opts) {
+    if (!opts.oneTimeSender)
+        return { sk: opts.authoritySk, tags: [], discard: () => { } };
+    const sk = generateSecretKey();
+    return { sk, tags: [[SENDER_TAG, getPublicKey(sk)]], discard: () => sk.fill(0) };
+}
 /** Announce the next epoch. See the module comment for what this is. */
 export function encodeRekeyEvent(opts) {
     require32(opts.authoritySk, 'authority secret key');
@@ -151,10 +159,16 @@ export function encodeRekeyEvent(opts) {
     const keys = {};
     const sealed = { v: 1, secret: base64urlnopad.encode(opts.next.secret) };
     const plaintext = JSON.stringify(sealed);
-    for (const raw of opts.closed ? [] : opts.recipients) {
-        const recipient = typeof raw === 'string' ? { device: raw } : raw;
-        const device = requireHex32(recipient.device, 'recipient device');
-        keys[device] = sealTo(plaintext, opts.authoritySk, device, recipient.credential);
+    const sender = oneTimeSenderOf(opts);
+    try {
+        for (const raw of opts.closed ? [] : opts.recipients) {
+            const recipient = typeof raw === 'string' ? { device: raw } : raw;
+            const device = requireHex32(recipient.device, 'recipient device');
+            keys[device] = sealTo(plaintext, sender.sk, device, recipient.credential);
+        }
+    }
+    finally {
+        sender.discard();
     }
     const body = {
         v: 1,
@@ -174,6 +188,7 @@ export function encodeRekeyEvent(opts) {
         tags: withExpiration([
             ['d', roomId],
             ['epoch', String(epoch)],
+            ...sender.tags,
         ], opts.expiresAt),
         content: nip44.v2.encrypt(JSON.stringify(body), opts.current.key),
     }, opts.authoritySk);
@@ -239,13 +254,14 @@ export function decodeRekeyEvent(event, opts) {
             notice.members = members;
         const device = getPublicKey(opts.deviceSk);
         const mine = Object.entries(body.keys).find(([to]) => hexEquals(to, device))?.[1];
-        if (typeof mine === 'string') {
+        const sender = sealSender(event);
+        if (typeof mine === 'string' && sender !== null) {
             // A copy none of this device's keys opens is no copy: sealed to a
             // seal key it has since erased, or one it never had. The rest of the
             // rekey still says who was removed, so it is read without the secret,
             // and the device asks for the epoch.
             try {
-                const sealed = JSON.parse(openSealed(mine, event.pubkey, opts.deviceSk, opts.sealSks));
+                const sealed = JSON.parse(openSealed(mine, sender, opts.deviceSk, opts.sealSks));
                 if (sealed.v === 1 && typeof sealed.secret === 'string') {
                     const secret = base64urlnopad.decode(sealed.secret);
                     if (secret.length === 32)
@@ -506,14 +522,23 @@ export function encodeEpochGrant(opts) {
         if (opts.passed !== undefined && opts.passed.length > 0)
             body.passed = passedListOf(opts.passed, body.epoch);
     }
+    const sender = oneTimeSenderOf(opts);
+    let content;
+    try {
+        content = sealTo(JSON.stringify(body), sender.sk, device, opts.credential);
+    }
+    finally {
+        sender.discard();
+    }
     return finalizeEvent({
         kind: KINDS.EPOCH_GRANT,
         created_at: opts.now,
         tags: withExpiration([
             ['d', roomId],
             ['p', device],
+            ...sender.tags,
         ], opts.expiresAt),
-        content: sealTo(JSON.stringify(body), opts.authoritySk, device, opts.credential),
+        content,
     }, opts.authoritySk);
 }
 /** Read the authority's answer to this device's own request. Null for
@@ -535,7 +560,10 @@ export function decodeEpochGrant(event, opts) {
         const addressed = event.tags.find((t) => t[0] === 'p')?.[1];
         if (addressed === undefined || !hexEquals(addressed, device))
             return null;
-        const body = JSON.parse(openSealed(event.content, event.pubkey, opts.deviceSk, opts.sealSks));
+        const sender = sealSender(event);
+        if (sender === null)
+            return null;
+        const body = JSON.parse(openSealed(event.content, sender, opts.deviceSk, opts.sealSks));
         if (body.v !== 1 || typeof body.request !== 'string' || !hexEquals(body.request, opts.request))
             return null;
         if (body.refused === 'removed' || body.refused === 'closed' || body.refused === 'unknown')

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export type { DeviceCredential, AccessTier, AgentRule, RoomPolicy, KindredProof
 export type { RelayTransport } from './transport.js';
 export { createDeviceCredential, verifyDeviceCredential, PERSON_CREDENTIAL_MAX_SECONDS, RestampedCredentialExpiryError, } from './credential.js';
 export type { CreateCredentialOptions, VerifyResult } from './credential.js';
-export { SEAL_TAG, isSealPubkey, generateSealKey, credentialSeal, sealTarget, sealTo, openSealed, newerCredential, } from './seal.js';
+export { SEAL_TAG, SENDER_TAG, sealSender, isSealPubkey, generateSealKey, credentialSeal, sealTarget, sealTo, openSealed, newerCredential, } from './seal.js';
 export type { SealKey } from './seal.js';
 export { deriveScoped, SCOPED_LABEL_PATTERN } from './scoped.js';
 export type { ScopedKeys } from './scoped.js';

package/dist/index.js

@@ -5,7 +5,7 @@ export { verifyEventUncached, boundedEventVerifier } from './verify.js';
 export { localIdentity } from './identity.js';
 export { KINDS } from './kinds.js';
 export { createDeviceCredential, verifyDeviceCredential, PERSON_CREDENTIAL_MAX_SECONDS, RestampedCredentialExpiryError, } from './credential.js';
-export { SEAL_TAG, isSealPubkey, generateSealKey, credentialSeal, sealTarget, sealTo, openSealed, newerCredential, } from './seal.js';
+export { SEAL_TAG, SENDER_TAG, sealSender, isSealPubkey, generateSealKey, credentialSeal, sealTarget, sealTo, openSealed, newerCredential, } from './seal.js';
 export { deriveScoped, SCOPED_LABEL_PATTERN } from './scoped.js';
 export { createSubKeyCertificate, verifySubKeyCertificate, SUB_KEY_CERTIFICATE_SCOPE, } from './sub-cert.js';
 export { generateRoomSecret, deriveRoom, encodeJoinUrl, decodeJoinUrl, parseRoomPolicy, ROOM_LABELS, } from './room.js';

package/dist/seal.d.ts

@@ -56,6 +56,26 @@ export declare function credentialSeal(credential: DeviceCredential): string | u
  * exists to shut out.
  */
 export declare function sealTarget(device: string, credential?: DeviceCredential): string;
+/**
+ * The tag on a rekey (kind 1462) or an authority's grant (kind 20469) that
+ * names the one-time key it was sealed from. The event is still signed by
+ * the authority, so the tag is the authority's word; the one-time secret is
+ * discarded once the copies are sealed, so whoever later takes the
+ * authority's key cannot recompute them. Forward secrecy step 1, see
+ * docs/seal-key.md, "One-time senders".
+ */
+export declare const SENDER_TAG = "from";
+/**
+ * Who sealed the copies in `event`: the key its single `from` tag names, or
+ * its signer when it carries none, which is every rekey and grant written
+ * before one-time senders. Null when the tags are unusable: more than one
+ * `from`, or one that is not a point on the curve. Only the authority could
+ * have signed either, so a reader treats null as a copy it cannot open.
+ */
+export declare function sealSender(event: {
+    pubkey: string;
+    tags: string[][];
+}): string | null;
 /** Seal `plaintext` from `senderSk` to `device`, by `sealTarget`. */
 export declare function sealTo(plaintext: string, senderSk: Uint8Array, device: string, credential?: DeviceCredential): string;
 /**

package/dist/seal.js

@@ -84,6 +84,31 @@ export function sealTarget(device, credential) {
         return to;
     return credentialSeal(credential) ?? to;
 }
+/**
+ * The tag on a rekey (kind 1462) or an authority's grant (kind 20469) that
+ * names the one-time key it was sealed from. The event is still signed by
+ * the authority, so the tag is the authority's word; the one-time secret is
+ * discarded once the copies are sealed, so whoever later takes the
+ * authority's key cannot recompute them. Forward secrecy step 1, see
+ * docs/seal-key.md, "One-time senders".
+ */
+export const SENDER_TAG = 'from';
+/**
+ * Who sealed the copies in `event`: the key its single `from` tag names, or
+ * its signer when it carries none, which is every rekey and grant written
+ * before one-time senders. Null when the tags are unusable: more than one
+ * `from`, or one that is not a point on the curve. Only the authority could
+ * have signed either, so a reader treats null as a copy it cannot open.
+ */
+export function sealSender(event) {
+    const tags = event.tags.filter((t) => t[0] === SENDER_TAG);
+    if (tags.length === 0)
+        return normaliseHex(event.pubkey);
+    if (tags.length > 1)
+        return null;
+    const value = tags[0][1];
+    return isSealPubkey(value) ? normaliseHex(value) : null;
+}
 /** Seal `plaintext` from `senderSk` to `device`, by `sealTarget`. */
 export function sealTo(plaintext, senderSk, device, credential) {
     return nip44.v2.encrypt(plaintext, nip44.v2.utils.getConversationKey(senderSk, sealTarget(device, credential)));

package/docs/seal-key.md

@@ -89,6 +89,41 @@ Not covered here:
 - `decodeEpochRequest` and `decodeMemberEpochRequest` return what they did in
   0.6.0. The desks read the credential internally.
 
+## One-time senders
+
+Forward secrecy step 1 (KithMoot `docs/2026-10-06-key-schedule-next-steps.md`,
+phase 2b). Every rekey copy and every authority grant used to be sealed from
+the authority's long-lived key, so whoever later took that key could
+recompute every past copy's conversation key and open it with nothing else.
+
+With `oneTimeSender: true`, `encodeRekeyEvent` and `encodeEpochGrant` draw a
+fresh key, seal every copy from it, name its public half in one
+`["from", <x-only hex>]` tag, and zero the secret before signing. The event
+is still signed by the authority, so the tag is the authority's word and a
+forger's `from` is never read (the signer check comes first).
+
+- A reader opens a copy with `sealSender(event)`: the single `from` tag's key,
+  or the signer when there is none. More than one `from`, or one off the
+  curve, is null: a rekey is then read without a secret (the device asks for
+  the epoch), and a grant is refused.
+- Taking the authority's key later no longer opens a copy. It still lets the
+  taker sign new rekeys and grants; that is the healing question, not this
+  one.
+- A copy is still sealed to the recipient's seal key, so a past copy stays
+  open to whoever holds that seal secret. Retiring seal keys older than the
+  history window is step 3.
+- The member grant (20472) has always been signed by a one-time key, and is
+  unchanged.
+
+**Readers first.** A reader older than 0.13.0 opens no copy from a one-time
+key. For a rekey that costs a round trip (it asks for the epoch); for a grant
+it costs the epoch. So `oneTimeSender` stays off in every writer until readers
+have shipped on every client and had a release in the field. Off, every
+event is byte-identical to before.
+
+`hostRoomEpoch` has no switch for it yet; adding one is part of turning
+writers on, alongside the keeper's own rekeys.
+
 ## Vectors
 
 `vectors/seal-vectors.json` (generated by `scripts/generate-seal.mjs`,
@@ -102,3 +137,7 @@ checked by `vectors/verify-seal.test.ts`):
   (byte-identical to a rekey with bare devices);
 - `epoch-grant-seal` and `member-grant-seal` (the thief replays the copied
   credential; the desk seals to the renewed one).
+- `rekey-one-time-sender` and `epoch-grant-one-time-sender` (the same rekey
+  and grant from a one-time key; the authority's key no longer opens a copy),
+  and the refusals `rekey-from-doubled`, `rekey-from-off-curve` and
+  `epoch-grant-from-off-curve`.

package/llms.txt

@@ -10,7 +10,7 @@ ESM-only, Node.js 22.13+. Four entry points: `@forgesworn/fold-kit` (circle prim
 npm install @forgesworn/fold-kit
 ```
 
-This file describes `main` (version 0.12.0), which can run ahead of the npm `latest` release; compare `npm view @forgesworn/fold-kit version` with the version of the API you need. To use an unreleased change, pin an immutable Git commit (a full SHA, for example from `git ls-remote https://github.com/forgesworn/fold-kit main`); the `prepare` script builds `dist/` on install:
+This file describes `main` (version 0.13.0), which can run ahead of the npm `latest` release; compare `npm view @forgesworn/fold-kit version` with the version of the API you need. To use an unreleased change, pin an immutable Git commit (a full SHA, for example from `git ls-remote https://github.com/forgesworn/fold-kit main`); the `prepare` script builds `dist/` on install:
 
 ```bash
 npm install "github:forgesworn/fold-kit#<commit>"
@@ -139,7 +139,7 @@ Invitation versions: v1 (`encodeJoinUrl`, the room secret in the link) is legacy
 - Quiet replies (see `docs/quiet-replies.md`): `hostRoomEpoch` waits a random `replyDelayMs` (`[min, max]` ms, default `DEFAULT_REPLY_DELAY_MS` = `[500, 2000]`, `[0, 0]` answers at once) before every grant or refusal, deciding when the wait ends; closing cancels waits. A participant is sent `removed`/`closed` at most once per `refuseAgainAfter` seconds (default `REFUSE_AGAIN_AFTER_SECONDS` = 3600) and `unknown` once per `reportUnknownEvery` (60); at most `maxRefusalsPerMinute` refusals (default `MAX_REFUSALS_PER_MINUTE` = 20) go out in any minute in all. Grants are never limited. A suppressed refusal still calls `onRefused`/`onUnknown`; its asker times out with the plain error. `random` and `schedule` (`ReplySchedule`) are injectable. `RefusalLimiter` (bounded to `REFUSAL_LIMITER_CAPACITY` = 256 keys) and `replyDelay(range, random)` are exported. Events and vectors are unchanged
 - Member epoch catch-up (see `docs/member-epoch-catch-up.md`): `encodeRekeyEvent({ ..., commit: true })` writes `epochCommitment(roomId, epoch, secret)` into the rekey body; `hostMemberEpochDesk(opts)` lets any current member answer; `requestRoomEpoch({ ..., members: memberEpochSource(opts) })` asks the authority and members, first verifiable answer wins; `requestMemberEpoch(opts)` asks members alone. Kinds `MEMBER_EPOCH_KINDS` = `{ REQUEST: 20471, GRANT: 20472 }`. A member grant carries the authority-signed rekeys from the asker's epoch to the current one; the asker verifies the chain itself (`decodeMemberEpochGrant`) and refuses a last epoch with no commitment (legacy: authority only), a chain that removes it or closes the room, and one that stops short of `expected`. A verified grant is `{ epoch, removed, passed }`: `passed` holds the epochs between the asker's and `epoch`, oldest first, and `requestRoomEpoch` carries it as an optional `passed` when a member answered. Codecs: `encodeMemberEpochRequest`, `decodeMemberEpochRequest`, `encodeMemberEpochGrant`, `readRekeyEvidence`, `deriveMemberEpochRequestKey`, `MAX_MEMBER_EPOCH_CHAIN` (32)
 - The known-members gate (#207, see `docs/member-epoch-catch-up.md`): once a room has removed anybody (`removed()` not empty), `hostRoomEpoch` and `hostMemberEpochDesk` grant only to a participant for which `known(participant)` is true; anybody else is reported through `onUnknown` (once per participant, and again every `reportUnknownEvery` seconds, default `REPORT_UNKNOWN_EVERY_SECONDS` = 60, while they keep asking) and refused: the authority answers `refused: 'unknown'` (an `EpochRefusal`), a member stays silent. `unknown` is not final: `requestRoomEpoch` keeps asking, calls its `onUnknown` once, and rejects with `EpochRefusedError('unknown')` only at its timeout; a desk looks at the requester's next ask afresh, so letting somebody in is making `known` say yes. No `known` after a removal means nobody is known. Member lists: `encodeRekeyEvent({ members })` writes the authority's list (removed dropped, sorted) into the body, read back as `RekeyNotice.members` and `RekeyEvidence.members`, and as `MemberEpochGrant.members` (newest in the chain); `hostRoomEpoch({ members })` puts it in its grants (`EpochGrant.members`). `readMemberList(raw)` reads one, undefined when malformed. Without `members` and with no removal every event is byte-identical to 0.5.1
-- Seal keys (see `docs/seal-key.md`): `createDeviceCredential({ ..., seal })` appends `["seal", <x-only pubkey>]` last, under the participant's signature; mint a fresh one per credential with `generateSealKey()` and keep its secret as you keep the device key (old copies are sealed to old seal keys; healing needs only that each new one is fresh). `encodeRekeyEvent` recipients may be `{ device, credential }`; `encodeEpochGrant` and `encodeMemberEpochGrant` take `credential`; each copy is sealed to `sealTarget(device, credential)`: the credential's seal key, else the device key (never back to the device key because the credential lapsed). Readers take `sealSks` (`decodeRekeyEvent`, `decodeEpochGrant`, `decodeMemberEpochGrant`) or a `sealSks()` getter (`requestRoomEpoch`, `memberEpochSource`) and try them before the device key (`openSealed`); a rekey copy nothing opens reads as no copy. Desks take `credentialFor(device)`, the newest credential the room has seen (keep it monotone), and seal to the newer of that and the presented one (`sealCredential`, `newerCredential`: later expiration, then later created_at). `credentialSeal(c)` is the pubkey, undefined for none, null when doubled or off the curve (sealed to the device key). Without seal keys every event is byte-identical to 0.6.0
+- Seal keys (see `docs/seal-key.md`): `createDeviceCredential({ ..., seal })` appends `["seal", <x-only pubkey>]` last, under the participant's signature; mint a fresh one per credential with `generateSealKey()` and keep its secret as you keep the device key (old copies are sealed to old seal keys; healing needs only that each new one is fresh). `encodeRekeyEvent` recipients may be `{ device, credential }`; `encodeEpochGrant` and `encodeMemberEpochGrant` take `credential`; each copy is sealed to `sealTarget(device, credential)`: the credential's seal key, else the device key (never back to the device key because the credential lapsed). Readers take `sealSks` (`decodeRekeyEvent`, `decodeEpochGrant`, `decodeMemberEpochGrant`) or a `sealSks()` getter (`requestRoomEpoch`, `memberEpochSource`) and try them before the device key (`openSealed`); a rekey copy nothing opens reads as no copy. Desks take `credentialFor(device)`, the newest credential the room has seen (keep it monotone), and seal to the newer of that and the presented one (`sealCredential`, `newerCredential`: later expiration, then later created_at). `credentialSeal(c)` is the pubkey, undefined for none, null when doubled or off the curve (sealed to the device key). Without seal keys every event is byte-identical to 0.6.0 - One-time senders (see `docs/seal-key.md`, "One-time senders"): `encodeRekeyEvent` and `encodeEpochGrant` take `oneTimeSender: true`, sealing every copy from a fresh key named in one `["from", <x-only pubkey>]` tag (still authority-signed) and zeroing it, so a later copy of the authority key opens no past copy; readers open with `sealSender(event)` (the `from` key, else the signer; null when doubled or off the curve: a rekey reads without a secret, a grant is refused). Keep writers off until every client's readers have shipped; off, events are byte-identical to 0.12.0.
 - Scheduled rekeys and the history window (see `docs/scheduled-rekey.md`): `encodeRekeyEvent({ ..., scheduled: true })` writes `"scheduled": true` inside the encrypted body (never a tag), and throws beside a non-empty `removed` or `closed`; `decodeRekeyEvent` (`RekeyNotice.scheduled`) and `readRekeyEvidence` (`RekeyEvidence.scheduled`) report `true` only when `removed` is empty and the room is not closed, so a contradictory body is still announced. `HISTORY_WINDOW_SECONDS` (30 days) and `MAX_HISTORY_EPOCHS` (16); `epochsInWindow(left, now)` keeps entries with `leftAt >= now - HISTORY_WINDOW_SECONDS`, newest first by epoch, first of a doubled epoch, at most 16, never throws. `encodeEpochGrant({ ..., passed })` takes `LeftEpoch[]` (`{ epoch, secret, leftAt }`) and writes `passed: [{ epoch, secret (base64url), left }]` oldest first, only when non-empty; it throws on more than 16, epoch 0 (the room secret is never carried), an epoch not below the granted one, a doubled epoch, a non-32-byte secret or a bad `leftAt`. `hostRoomEpoch({ past })` is asked on every grant, filtered to what the encoder accepts and to `epochsInWindow`, so a bad `past()` costs the history, not the grant. `decodeEpochGrant` returns `EpochGrant.passed` (`leftAt` set) only when the list is exactly in that form, else drops the field and keeps the grant; `decodeMemberEpochGrant` sets `leftAt` on each passed epoch from the next rekey's `created_at`. `MAX_MEMBER_EPOCH_CHAIN` (32) is a different limit. Without the marker and `passed` every event is byte-identical to 0.7.0, and a 0.7.0 reader ignores both
 - `canonicalAdmins(admins)` / `signAdmins(opts)` / `verifyAdmins(opts)` - the authority's signed admin list
 - `canonicalChannels(channels)` / `signChannels(opts)` / `verifyChannels(opts)` - the authority's signed channel list; `CHANNEL_NAME`, `RESERVED_CHANNELS`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgesworn/fold-kit",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Circle primitives for private Nostr groups nobody operates: epoch keys, link invites, removal by rekey, device credentials.",
   "type": "module",
   "main": "./dist/index.js",

package/vectors/seal-vectors.json

@@ -623,6 +623,310 @@
           },
           "thief": null
         }
+      },
+      {
+        "name": "rekey-one-time-sender",
+        "kind": "positive",
+        "note": "rekey-seal's rekey with `oneTimeSender`: tags d, epoch, then [\"from\", x-only pubkey of a key made for this rekey alone], still signed by the authority, so the tag is the authority's word. Every copy is sealed from that one-time key to the recipient's seal key (or device key), and the one-time secret is discarded, so whoever later takes the authority's key cannot recompute the copies (`authorityOpens` false). A reader opens its copy with the key the single `from` tag names (`sealSender`), and with the signer when there is none, which is every earlier rekey. `randomHex`: the 48-byte seed for the one-time key (`senderSkHex`), one seal nonce per recipient in order, the body nonce, the signature aux-rand. A reader older than this opens no copy, reads the rekey without a secret and asks for the epoch.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "authoritySkHex": "bb058b43370d37b7ed3f09e3a36a6ffcc88a8dad56c5ee204b1715240a1466e0",
+          "previousKeyHex": "09126b23a6148694280325e5a433c1badbc853026c8e71c0833ffd4bd0ea08ab",
+          "next": {
+            "epoch": 1,
+            "secretHex": "cc4e6941abd893daab2fdce0bbb182816b531fbc04b9531fdc5d03fd742fb26b"
+          },
+          "recipients": [
+            {
+              "device": "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b",
+              "credential": {
+                "id": "3c3f64a769c826a89f2712ed9898e43afacc5f2784201999e8ca0ed5cdcf3d6c",
+                "pubkey": "3683caad0bf9bb5a653582155c0ba9192fd23d7d6c717a7b0d233c8356a7042f",
+                "created_at": 1800000000,
+                "kind": 20460,
+                "tags": [
+                  [
+                    "d",
+                    "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+                  ],
+                  [
+                    "device",
+                    "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+                  ],
+                  [
+                    "expiration",
+                    "1800043200"
+                  ],
+                  [
+                    "seal",
+                    "63a40c9bc84c065f4aab7e63208ea37c3edcd3ab47a334b157cf000409c7eaaf"
+                  ]
+                ],
+                "content": "",
+                "sig": "fdd0c5f23d2f1531594100470d6fe6c87d6c28d2185898b49844b664ffcb65f3c76ce0b9fcef3166708baca068d7f9d2ee74a827f56140b6cef11591ce942049"
+              }
+            },
+            "1cddb17ae843752d2469ea50b2a6bd1468edbb75b7913ea58ba7847663cb1b8e"
+          ],
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "bareDeviceSkHex": "32796464cb7434a5d397f03cce5055df28f9be8d15ce4bf14760d764bbd2e156",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "copiedSealSkHex": "22b29538be86feaf0dbe57fcd046cc95ca39082e813d450d8d9d653a2434a374",
+          "createdAt": 1800000000,
+          "event": {
+            "id": "3f38d5f8a93cb0818f9a62fccc8ba59b44ebc413c1369205447f840e46bfb474",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 1462,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "epoch",
+                "1"
+              ],
+              [
+                "from",
+                "02f71d0f7235cbe6e623bc1542539c9db10601a3a892af483783614c00c7fd99"
+              ]
+            ],
+            "content": "AmcNeMrs/5cl6E/Z1PoCcQXOxzckQIRSjE9XOZJKvrsqFN0ZfMu/0hPX0dWFqdgAWRDZ5/K+9O3ajNsKlDmnx5zcAtlrzeJUTDGtN6YrwcorfL6NRMeSz9bnic0jAGAxo+Zj5n0FUV9qOzAkjKktseXy6y2oQeQ3gN2uPW1GXSOcaH++d3YwmiND6c48I8SlsNB5wRVawNb5Dm6UViC4h0wpbBR9sLqA08+p8IMFx2HxmENDbNNMfeQVcMhNGZ+XobZcsH4Zd0JNVxRVUGF0TOYCfaOQFAzO3LxfXI9tcC9vaisCA/DbGoGiz5nqOwU4xnsF5RgdX6yX+xIQXSzCtne69p/tdjePhsL8WmlENE131aSBdY/L7bUAumu+FJxfVJBzNCz+y/o0noBLirOrUuUIqWxFnQ/zoWsE+gYCU9Um9LvtbhK+m1+COhl6K09ruh/qlcZBn7OEciUywGZSkRadpm4kktc5cCfGbdrlkfVPwgrJiRVYLkIC+O+N+xqx037XLOtI3wC460QDnaoii207OrsdGip8F5K1sZ8ZV/Mc+gNmcCKAZJEGaoyowPvP4cYXMyos7j3MCZ0lpwi1E8jwyXYJZK17JKXmykEpBywPpYLSgBQR9C9yJ6oCfaVsxkOBVgbEiPKpA+hGngsiDmGBoy41VdgpA9ZCBTIH5W8B2z1xqCk+dHVkczJqYNpM+Dad0Xagq42rnK1kLff2bFsIKxly3ak1uFRYBCQbS74BEo2kbczOAn1XLfPYMLiEiMCdjXgILzVgqe4TVjue9Nv7Zak5iheUPqLVZfxTbuQUWIWrLakQWSVHfQ8c+/L98/5M9TsgYSIV5BS5JCABvbCVe4RHeq4ibECcsf41I2qPUeCSXxHuTvJ26L/T3ONpAEzXRw2+8tJNaK3Plczm5f9TfYPL3yuZGcplKsgPwogm0us=",
+            "sig": "a6e036a4b6ac94703f747337bf28c308a295fcfc2ab3c028d5a35cc50969ba19807a9ba14252ef7782e4b4bfd3395c71986eea1cdcdc36e2fe18a77d9ce1219d"
+          },
+          "randomHex": [
+            "a110c4cffaadabb2fedbf6279627cc857757f036ecaffdcb89452e2eb12acc8349c693f9cce385720b83f75629ae26e6",
+            "6d4bbae698b19d076387d818c6a9b8aaaa23ab42850bb933ab1ab0ab4a36ce91",
+            "a25e6555c2cbbf30733f70ba666453a3712cf5dbefd4c1cea47fa9b70b1b691a",
+            "670d78caecff9725e84fd9d4fa027105cec737244084528c4f5739924abebb2a",
+            "18c1fc0b6372dc662bcafd2d4704e5c1f4bcc9c61b1e129a91dec165a6296212"
+          ],
+          "senderSkHex": "4405467674110e0cb5278a657356cac70724f7442d2dc3ade9e350768088ff67"
+        },
+        "output": {
+          "sealSender": "02f71d0f7235cbe6e623bc1542539c9db10601a3a892af483783614c00c7fd99",
+          "renewedDevice": {
+            "epoch": 1,
+            "secretHex": "cc4e6941abd893daab2fdce0bbb182816b531fbc04b9531fdc5d03fd742fb26b"
+          },
+          "thief": {
+            "epoch": 1
+          },
+          "bareDevice": {
+            "epoch": 1,
+            "secretHex": "cc4e6941abd893daab2fdce0bbb182816b531fbc04b9531fdc5d03fd742fb26b"
+          },
+          "authorityOpens": {
+            "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b": false,
+            "1cddb17ae843752d2469ea50b2a6bd1468edbb75b7913ea58ba7847663cb1b8e": false
+          }
+        }
+      },
+      {
+        "name": "rekey-from-doubled",
+        "kind": "negative",
+        "note": "rekey-one-time-sender's content re-signed by the authority with two `from` tags. Only the authority could sign it, so it is a broken writer, not an attack: `sealSender` is null, the rekey is still read for its epoch and removals, and no copy is opened (no secretHex); the device asks for the epoch.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "previousKeyHex": "09126b23a6148694280325e5a433c1badbc853026c8e71c0833ffd4bd0ea08ab",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "event": {
+            "id": "fc8be7e8e1965a5888ca5351706456d76c8e548c3fc0a9378e0bb1caf4be23f6",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 1462,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "epoch",
+                "1"
+              ],
+              [
+                "from",
+                "02f71d0f7235cbe6e623bc1542539c9db10601a3a892af483783614c00c7fd99"
+              ],
+              [
+                "from",
+                "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533"
+              ]
+            ],
+            "content": "AmcNeMrs/5cl6E/Z1PoCcQXOxzckQIRSjE9XOZJKvrsqFN0ZfMu/0hPX0dWFqdgAWRDZ5/K+9O3ajNsKlDmnx5zcAtlrzeJUTDGtN6YrwcorfL6NRMeSz9bnic0jAGAxo+Zj5n0FUV9qOzAkjKktseXy6y2oQeQ3gN2uPW1GXSOcaH++d3YwmiND6c48I8SlsNB5wRVawNb5Dm6UViC4h0wpbBR9sLqA08+p8IMFx2HxmENDbNNMfeQVcMhNGZ+XobZcsH4Zd0JNVxRVUGF0TOYCfaOQFAzO3LxfXI9tcC9vaisCA/DbGoGiz5nqOwU4xnsF5RgdX6yX+xIQXSzCtne69p/tdjePhsL8WmlENE131aSBdY/L7bUAumu+FJxfVJBzNCz+y/o0noBLirOrUuUIqWxFnQ/zoWsE+gYCU9Um9LvtbhK+m1+COhl6K09ruh/qlcZBn7OEciUywGZSkRadpm4kktc5cCfGbdrlkfVPwgrJiRVYLkIC+O+N+xqx037XLOtI3wC460QDnaoii207OrsdGip8F5K1sZ8ZV/Mc+gNmcCKAZJEGaoyowPvP4cYXMyos7j3MCZ0lpwi1E8jwyXYJZK17JKXmykEpBywPpYLSgBQR9C9yJ6oCfaVsxkOBVgbEiPKpA+hGngsiDmGBoy41VdgpA9ZCBTIH5W8B2z1xqCk+dHVkczJqYNpM+Dad0Xagq42rnK1kLff2bFsIKxly3ak1uFRYBCQbS74BEo2kbczOAn1XLfPYMLiEiMCdjXgILzVgqe4TVjue9Nv7Zak5iheUPqLVZfxTbuQUWIWrLakQWSVHfQ8c+/L98/5M9TsgYSIV5BS5JCABvbCVe4RHeq4ibECcsf41I2qPUeCSXxHuTvJ26L/T3ONpAEzXRw2+8tJNaK3Plczm5f9TfYPL3yuZGcplKsgPwogm0us=",
+            "sig": "6f034c009f3eb02e069355d5a065f3aa72d1fe92dd5e6bc1bedbd905dfca08370fdc39b21470341397eafc2a5ad1c977c4658811aab3198937099ce844f0db37"
+          }
+        },
+        "output": {
+          "sealSender": null,
+          "renewedDevice": {
+            "epoch": 1
+          }
+        }
+      },
+      {
+        "name": "rekey-from-off-curve",
+        "kind": "negative",
+        "note": "The same with one `from` tag that is not the x coordinate of any point (x = 5): `sealSender` null, read without a secret.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "previousKeyHex": "09126b23a6148694280325e5a433c1badbc853026c8e71c0833ffd4bd0ea08ab",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "event": {
+            "id": "3d0722b71fa5a04938936d6fd89ba718830a59c89ecb060931f442394e1702ab",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 1462,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "epoch",
+                "1"
+              ],
+              [
+                "from",
+                "0000000000000000000000000000000000000000000000000000000000000005"
+              ]
+            ],
+            "content": "AmcNeMrs/5cl6E/Z1PoCcQXOxzckQIRSjE9XOZJKvrsqFN0ZfMu/0hPX0dWFqdgAWRDZ5/K+9O3ajNsKlDmnx5zcAtlrzeJUTDGtN6YrwcorfL6NRMeSz9bnic0jAGAxo+Zj5n0FUV9qOzAkjKktseXy6y2oQeQ3gN2uPW1GXSOcaH++d3YwmiND6c48I8SlsNB5wRVawNb5Dm6UViC4h0wpbBR9sLqA08+p8IMFx2HxmENDbNNMfeQVcMhNGZ+XobZcsH4Zd0JNVxRVUGF0TOYCfaOQFAzO3LxfXI9tcC9vaisCA/DbGoGiz5nqOwU4xnsF5RgdX6yX+xIQXSzCtne69p/tdjePhsL8WmlENE131aSBdY/L7bUAumu+FJxfVJBzNCz+y/o0noBLirOrUuUIqWxFnQ/zoWsE+gYCU9Um9LvtbhK+m1+COhl6K09ruh/qlcZBn7OEciUywGZSkRadpm4kktc5cCfGbdrlkfVPwgrJiRVYLkIC+O+N+xqx037XLOtI3wC460QDnaoii207OrsdGip8F5K1sZ8ZV/Mc+gNmcCKAZJEGaoyowPvP4cYXMyos7j3MCZ0lpwi1E8jwyXYJZK17JKXmykEpBywPpYLSgBQR9C9yJ6oCfaVsxkOBVgbEiPKpA+hGngsiDmGBoy41VdgpA9ZCBTIH5W8B2z1xqCk+dHVkczJqYNpM+Dad0Xagq42rnK1kLff2bFsIKxly3ak1uFRYBCQbS74BEo2kbczOAn1XLfPYMLiEiMCdjXgILzVgqe4TVjue9Nv7Zak5iheUPqLVZfxTbuQUWIWrLakQWSVHfQ8c+/L98/5M9TsgYSIV5BS5JCABvbCVe4RHeq4ibECcsf41I2qPUeCSXxHuTvJ26L/T3ONpAEzXRw2+8tJNaK3Plczm5f9TfYPL3yuZGcplKsgPwogm0us=",
+            "sig": "eff2cc0225466dd6367fda5509d36fcb17e88b28039148b17870100ebe65b7658b005a18d0563ae01003ff88833d0716d01029b2e1b78456d63e19d27261cb24"
+          }
+        },
+        "output": {
+          "sealSender": null,
+          "renewedDevice": {
+            "epoch": 1
+          }
+        }
+      },
+      {
+        "name": "epoch-grant-one-time-sender",
+        "kind": "positive",
+        "note": "epoch-grant-seal's grant with `oneTimeSender`: tags d, p, then [\"from\", one-time pubkey], signed by the authority, content sealed from the one-time key to the renewed seal key. `randomHex`: the 48-byte seed for the one-time key (`senderSkHex`), body nonce, aux-rand. The renewed device opens it; the thief does not; the authority's key no longer opens it. A reader older than this cannot open it at all, which is why writers wait for readers.",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "authoritySkHex": "bb058b43370d37b7ed3f09e3a36a6ffcc88a8dad56c5ee204b1715240a1466e0",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "now": 1800000000,
+          "request": "ef8f52180b25300214a75780fc12a89cb1d4ee1a88a78b2f8afb92605769e87a",
+          "credential": {
+            "id": "3c3f64a769c826a89f2712ed9898e43afacc5f2784201999e8ca0ed5cdcf3d6c",
+            "pubkey": "3683caad0bf9bb5a653582155c0ba9192fd23d7d6c717a7b0d233c8356a7042f",
+            "created_at": 1800000000,
+            "kind": 20460,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "device",
+                "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+              ],
+              [
+                "expiration",
+                "1800043200"
+              ],
+              [
+                "seal",
+                "63a40c9bc84c065f4aab7e63208ea37c3edcd3ab47a334b157cf000409c7eaaf"
+              ]
+            ],
+            "content": "",
+            "sig": "fdd0c5f23d2f1531594100470d6fe6c87d6c28d2185898b49844b664ffcb65f3c76ce0b9fcef3166708baca068d7f9d2ee74a827f56140b6cef11591ce942049"
+          },
+          "epoch": {
+            "epoch": 2,
+            "secretHex": "1173b8e8457a46fdb6ae949e37aa41ce259534d4bb4f15a5fdb74aefc83344f5"
+          },
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "copiedSealSkHex": "22b29538be86feaf0dbe57fcd046cc95ca39082e813d450d8d9d653a2434a374",
+          "event": {
+            "id": "38ad58597fa0c34a18e3975e755c27523b4c1cdf60d4a49aa89d2817f734dc76",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 20469,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "p",
+                "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+              ],
+              [
+                "from",
+                "0f44811c4dab721de6ee8e8d740b264fe8e106453fca7fe2a4543656cf10bb98"
+              ]
+            ],
+            "content": "Ar+D/3yOjgZRgyeW88MD9C17M37/kTTSSXfT5gTHvH8ecKBRUai4cGo/MMEiMBPN7b/YLj+HKOab20VjFGh1b6+CwWjoruSUpgvxNvZUcKiOF2lmZp6Awd2R46k55IJ8ShyGHQ674wyHyBs7J2GbZeEZZlsAPOztW0iCXEB4RzdUP4HrmyYbhKxY9g+8juxhT91aMIH7bmFN+kOCrOO3W+4gaj73tGRyB6OBvMKledoK1ypL+COkXqj4GzFUcDsG88fFOD6+JMnVoUDNhyobovbxRsj6B5wApTkr6Bj6nAr5+er5RTTEBAwmUuIc/V7qFzK76NUmYGunr6r5bZHaxLld3Q==",
+            "sig": "7992b0b101abb281e45c6066132e571a30ef8b02fcd0eb25f8764cf967c960d89f8d6def75e7bf91cf31d6af1efaa7b9d0171eaeba7482521afe9bc07d1fde17"
+          },
+          "randomHex": [
+            "5ac80b90d9396022bf334b58968aec74e7c8c72a7f62635b91a13924910c605a62efa5fac4e4ce2c169755acc6d1b49c",
+            "bf83ff7c8e8e0651832796f3c303f42d7b337eff9134d24977d3e604c7bc7f1e",
+            "a100e717ef4874d688fb51f37339cc25d5eddb8a17f3c554f939a7d3098ad8fa"
+          ],
+          "senderSkHex": "5b2583975fba6efa84bdfd6fa48d2422e1d31090140b71d4cadc19e4ed5ee25d"
+        },
+        "output": {
+          "sealSender": "0f44811c4dab721de6ee8e8d740b264fe8e106453fca7fe2a4543656cf10bb98",
+          "renewedDevice": {
+            "epoch": 2,
+            "secretHex": "1173b8e8457a46fdb6ae949e37aa41ce259534d4bb4f15a5fdb74aefc83344f5"
+          },
+          "thief": null,
+          "authorityOpens": false
+        }
+      },
+      {
+        "name": "epoch-grant-from-off-curve",
+        "kind": "negative",
+        "note": "epoch-grant-one-time-sender's content re-signed by the authority with a `from` tag off the curve: the grant is refused (null).",
+        "input": {
+          "roomId": "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c",
+          "authority": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+          "deviceSkHex": "678d943bfdab0df34f3945be66ca867a4c15b507d7a9c125651f9018a905f305",
+          "now": 1800000000,
+          "request": "ef8f52180b25300214a75780fc12a89cb1d4ee1a88a78b2f8afb92605769e87a",
+          "renewedSealSkHex": "7729de6b913094fc7fd121d12671448494184b9eff28633869a0c81567291035",
+          "event": {
+            "id": "3185002094d21dd5f585b6e718c8587a5ab494235e73a5351f51ba0648af5db9",
+            "pubkey": "4fca1ba4b39e24ea0acea325af3e6a62315903952c277e197cccfe8f0143c533",
+            "created_at": 1800000000,
+            "kind": 20469,
+            "tags": [
+              [
+                "d",
+                "58c0b5a427b80559f5b67f35e74c686f630259dcdafca2ab03e3b082f4a1740c"
+              ],
+              [
+                "p",
+                "f29e30f72c9aaaa5066aa366afd4f0970e13853d10922cf5ba2ece21dc18ee5b"
+              ],
+              [
+                "from",
+                "0000000000000000000000000000000000000000000000000000000000000005"
+              ]
+            ],
+            "content": "Ar+D/3yOjgZRgyeW88MD9C17M37/kTTSSXfT5gTHvH8ecKBRUai4cGo/MMEiMBPN7b/YLj+HKOab20VjFGh1b6+CwWjoruSUpgvxNvZUcKiOF2lmZp6Awd2R46k55IJ8ShyGHQ674wyHyBs7J2GbZeEZZlsAPOztW0iCXEB4RzdUP4HrmyYbhKxY9g+8juxhT91aMIH7bmFN+kOCrOO3W+4gaj73tGRyB6OBvMKledoK1ypL+COkXqj4GzFUcDsG88fFOD6+JMnVoUDNhyobovbxRsj6B5wApTkr6Bj6nAr5+er5RTTEBAwmUuIc/V7qFzK76NUmYGunr6r5bZHaxLld3Q==",
+            "sig": "ba59c2a57832972de1b73a75724f6636fd2cea73e6a9040e05bc3ea022a10a5260d866d94c49dd16408237ea62a65e9bfb39cf332099a23f560ff7ca463eed02"
+          }
+        },
+        "output": {
+          "renewedDevice": null
+        }
       }
     ]
   }