@livedesk/hub 0.1.31 → 0.1.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@livedesk/runtime-core": "0.1.3",
+    "@livedesk/runtime-core": "0.1.4",
     "@openai/codex-sdk": "0.145.0",
     "cors": "^2.8.5",
     "express": "^4.21.2",

package/src/filesystem/transfer-jobs.js

@@ -322,7 +322,11 @@ export class HubTransferJobs {
     try {
       await job.onComplete({ completed, job: snapshot(job) });
     } catch (error) {
-      job.error = error instanceof Error ? error.message : String(error);
+      // A completion callback can be the durable security-audit gate. Never
+      // leave a job looking successful when that final record was not stored.
+      job.state = 'failed';
+      job.error = `completion-callback-failed:${error instanceof Error ? error.message : String(error)}`;
+      job.completedAt ||= new Date().toISOString();
       markUpdated(job);
     }
   }

package/src/remote-hub.js

@@ -2331,11 +2331,12 @@ export function createRemoteHub(options = {}) {
     const getSecurityIdentity = typeof options.getSecurityIdentity === 'function'
         ? options.getSecurityIdentity
         : () => ({ accountId: safeString(options.accountId || env.LIVEDESK_ACCOUNT_ID, 128) });
-    udpTransport?.setRendezvousProofIssuer?.(({ roomId, deviceId, ttlMs }) => {
+    udpTransport?.setRendezvousProofIssuer?.(({ roomId, deviceId, role, ttlMs }) => {
         const identity = getSecurityIdentity() || {};
         return deviceCredentialAuthority.issueRendezvousProof({
             roomId,
             deviceId,
+            role,
             ttlMs,
             accountId: safeString(identity.accountId, 128)
         });
@@ -8321,7 +8322,7 @@ export function createRemoteHub(options = {}) {
         };
     }
 
-    function sendCommand(deviceId, command) {
+    function sendCommand(deviceId, command) {
         const device = devices.get(String(deviceId || ''));
         const commandName = safeString(command?.command || 'ping', 80);
         const requiredPermission = commandName === 'input.control'
@@ -8387,8 +8388,62 @@ export function createRemoteHub(options = {}) {
             command: payload.command,
             channel: dedicatedFileSocket ? 'file' : 'control'
         });
-        return { ok: true, commandId };
-    }
+        return { ok: true, commandId };
+    }
+
+    async function sendCommandAwaitResult(deviceId, command, options = {}) {
+        const normalizedDeviceId = safeString(deviceId, 160);
+        const device = devices.get(normalizedDeviceId);
+        const commandId = safeString(command?.commandId, 128) || crypto.randomUUID();
+        const commandWithId = { ...(command || {}), commandId };
+
+        if (device?.synthetic === true && device.connected) {
+            const sent = sendCommand(normalizedDeviceId, commandWithId);
+            return {
+                ...sent,
+                queued: sent.ok === true,
+                acknowledged: sent.ok === true,
+                acknowledgement: sent.ok === true
+                    ? { ok: true, commandId, result: { ok: true, synthetic: true }, error: '' }
+                    : { ok: false, commandId, result: null, error: sent.error || 'command-not-sent' }
+            };
+        }
+
+        if (!device?.socket || device.socket.destroyed || !device.connected) {
+            const sent = sendCommand(normalizedDeviceId, commandWithId);
+            return {
+                ...sent,
+                queued: false,
+                acknowledged: false,
+                acknowledgement: {
+                    ok: false,
+                    commandId,
+                    result: null,
+                    error: sent.error || 'device-not-connected'
+                }
+            };
+        }
+
+        const timeoutMs = clampNumber(options.timeoutMs, 1000, 120_000, 30_000);
+        // Register before writing: a loopback Agent can return command.result in
+        // the same event-loop turn as the command write.
+        const acknowledgementPromise = waitForCommandResult(device, commandId, timeoutMs);
+        const sent = sendCommand(normalizedDeviceId, commandWithId);
+        if (!sent.ok) {
+            failPendingCommandResultWaiter(device, commandId, sent.error || 'command-not-sent');
+        }
+        const acknowledgement = await acknowledgementPromise;
+        return {
+            ...sent,
+            ok: sent.ok === true && acknowledgement.ok === true,
+            queued: sent.ok === true,
+            acknowledged: acknowledgement.ok === true,
+            acknowledgement,
+            error: acknowledgement.ok === true
+                ? undefined
+                : acknowledgement.error || sent.error || 'command-result-failed'
+        };
+    }
 
     function refreshDevicePolicies(deviceIds = undefined) {
         const requestedIds = Array.isArray(deviceIds) && deviceIds.length > 0
@@ -11277,9 +11332,10 @@ export function createRemoteHub(options = {}) {
         retryTaskBatch,
         listDeviceFrames,
         disconnectDevice,
-        assignDeviceSlot,
-        sendCommand,
-        refreshDevicePolicies,
+        assignDeviceSlot,
+        sendCommand,
+        sendCommandAwaitResult,
+        refreshDevicePolicies,
         sendLegacyClientUpdate,
         sendInputControl,
         releaseInputOwner,
@@ -11311,6 +11367,7 @@ export function createRemoteHub(options = {}) {
         getSecurityStatus: () => ({
             hubId: deviceCredentialAuthority.hubId,
             hubPublicKey: deviceCredentialAuthority.hubPublicKey,
+            hubIssuerKeyId: deviceCredentialAuthority.hubIssuerKeyId,
             direct: secureDirectAcceptor.getStatus(),
             devices: deviceCredentialAuthority.listDevices()
         }),

package/src/security/device-credential-authority.js

@@ -174,6 +174,9 @@ export function createDeviceCredentialAuthority({
   if (!privateKeyText) throw securityError('hub-private-key-secure-store-unavailable');
   const hubPrivateKey = requireP256PrivateKey(privateKeyText);
   const hubPublic = requireP256PublicKey(authority.publicKey);
+  const hubIssuerKeyId = crypto.createHash('sha256')
+    .update(Buffer.from(hubPublic.text, 'base64url'))
+    .digest('base64url');
   const derivedPublic = crypto.createPublicKey(hubPrivateKey).export({ format: 'der', type: 'spki' }).toString('base64url');
   if (derivedPublic !== hubPublic.text) throw securityError('hub-device-authority-key-mismatch');
   const hubId = clean(authority.hubId, 128);
@@ -183,18 +186,33 @@ export function createDeviceCredentialAuthority({
     registry = { version: AUTHORITY_VERSION, devices: {} };
   }
 
-  function persistRegistry() {
-    atomicPrivateJson(registryPath, registry);
+  function persistRegistry(nextRegistry = registry) {
+    atomicPrivateJson(registryPath, nextRegistry);
   }
 
-  function issueCredential({ accountId, deviceId, devicePublicKey, replace = false }) {
+  function normalizeCredentialRequest({ accountId, deviceId, devicePublicKey } = {}) {
     const owner = clean(accountId, 128);
     const id = clean(deviceId, 128);
     if (!owner) throw securityError('device-account-required');
     if (!id) throw securityError('device-id-required');
     const deviceKey = requireP256PublicKey(devicePublicKey);
+    return { owner, id, deviceKey };
+  }
+
+  function assertEnrollmentAllowed(request) {
+    const normalized = normalizeCredentialRequest(request);
+    const existing = registry.devices[normalized.id];
+    if (existing && !existing.revokedAt) throw securityError('device-already-enrolled');
+    if (!existing && Object.keys(registry.devices).length >= MAX_DEVICES) {
+      throw securityError('device-registry-capacity');
+    }
+    return true;
+  }
+
+  function issueCredential({ accountId, deviceId, devicePublicKey }) {
+    const { owner, id, deviceKey } = normalizeCredentialRequest({ accountId, deviceId, devicePublicKey });
     const existing = registry.devices[id];
-    if (existing && !existing.revokedAt && !replace) throw securityError('device-already-enrolled');
+    if (existing && !existing.revokedAt) throw securityError('device-already-enrolled');
     if (!existing && Object.keys(registry.devices).length >= MAX_DEVICES) throw securityError('device-registry-capacity');
     const issuedAt = Math.floor(now());
     const payload = {
@@ -213,18 +231,25 @@ export function createDeviceCredentialAuthority({
       dsaEncoding: 'ieee-p1363'
     }).toString('base64url');
     const credential = `${payloadText}.${signature}`;
-    registry.devices[id] = {
-      serial: payload.serial,
-      accountId: owner,
-      hubId,
-      devicePublicKey: deviceKey.text,
-      credential,
-      issuedAt,
-      expiresAt: payload.expiresAt,
-      revokedAt: '',
-      lastConnectedAt: ''
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: {
+          serial: payload.serial,
+          accountId: owner,
+          hubId,
+          devicePublicKey: deviceKey.text,
+          credential,
+          issuedAt,
+          expiresAt: payload.expiresAt,
+          revokedAt: '',
+          lastConnectedAt: ''
+        }
+      }
     };
-    persistRegistry();
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return { credential, payload: { ...payload }, hubPublicKey: hubPublic.text };
   }
 
@@ -279,23 +304,26 @@ export function createDeviceCredentialAuthority({
     }).toString('base64url');
   }
 
-  function issueRendezvousProof({ roomId, accountId, deviceId, ttlMs = 60_000 } = {}) {
+  function issueRendezvousProof({ roomId, accountId, deviceId, role, ttlMs = 60_000 } = {}) {
     const room = clean(roomId, 160);
     const owner = clean(accountId, 128);
     const device = clean(deviceId, 128);
+    const normalizedRole = clean(role, 16).toLowerCase();
     if (!room || !owner || !device) throw securityError('rendezvous-proof-binding-required');
+    if (!['hub', 'client'].includes(normalizedRole)) throw securityError('rendezvous-proof-role-required');
     const issuedAt = Math.floor(now());
     const payload = {
-      version: 1,
-      protocol: 'livedesk.udp.rendezvous-proof.v1',
+      version: 2,
+      protocol: 'livedesk.udp.rendezvous-proof.v2',
+      issuerKeyId: hubIssuerKeyId,
       roomId: room,
+      role: normalizedRole,
       accountId: owner,
       hubId,
       deviceId: device,
       issuedAt,
       expiresAt: issuedAt + Math.max(10_000, Math.min(120_000, Number(ttlMs) || 60_000)),
-      nonce: crypto.randomBytes(16).toString('base64url'),
-      hubPublicKey: hubPublic.text
+      nonce: crypto.randomBytes(16).toString('base64url')
     };
     const payloadText = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
     return { proof: `${payloadText}.${signHubMessage(payloadText)}`, payload };
@@ -305,9 +333,19 @@ export function createDeviceCredentialAuthority({
     const id = clean(deviceId, 128);
     const record = registry.devices[id];
     if (!record || record.revokedAt) return false;
-    record.revokedAt = new Date(now()).toISOString();
-    record.revokeReason = clean(reason, 160);
-    persistRegistry();
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: {
+          ...record,
+          revokedAt: new Date(now()).toISOString(),
+          revokeReason: clean(reason, 160)
+        }
+      }
+    };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return true;
   }
 
@@ -315,8 +353,15 @@ export function createDeviceCredentialAuthority({
     const id = clean(deviceId, 128);
     const record = registry.devices[id];
     if (!record || record.revokedAt) return false;
-    record.lastConnectedAt = new Date(now()).toISOString();
-    persistRegistry();
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: { ...record, lastConnectedAt: new Date(now()).toISOString() }
+      }
+    };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return true;
   }
 
@@ -335,14 +380,17 @@ export function createDeviceCredentialAuthority({
 
   function clearDevices() {
     const removed = Object.keys(registry.devices).length;
-    registry = { version: AUTHORITY_VERSION, devices: {} };
-    persistRegistry();
+    const nextRegistry = { version: AUTHORITY_VERSION, devices: {} };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return removed;
   }
 
   return Object.freeze({
     hubId,
     hubPublicKey: hubPublic.text,
+    hubIssuerKeyId,
+    assertEnrollmentAllowed,
     issueCredential,
     verifyCredential,
     verifyDeviceSignature,

package/src/security/security-audit-store.js

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { appendFile, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -85,6 +85,25 @@ function parseSeal(raw) {
   }
 }
 
+async function syncFile(filePath, flags = 'r') {
+  const handle = await open(filePath, flags, 0o600);
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+async function appendDurably(filePath, value) {
+  const handle = await open(filePath, 'a', 0o600);
+  try {
+    await handle.writeFile(value, { encoding: 'utf8' });
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
 export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.livedesk') } = {}) {
   const filePath = path.join(dataDir, 'security', 'security-audit-v1.jsonl');
   const sealStore = createOsSecretStore({
@@ -175,6 +194,7 @@ export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.l
     }
     const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
     await writeFile(temporary, `${rebuilt.map(record => JSON.stringify(record)).join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
+    await syncFile(temporary);
     await rename(temporary, filePath);
     records = rebuilt;
     seal.headHash = previousHash;
@@ -195,7 +215,9 @@ export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.l
         const recordHash = hashRecord(previousHash, payloadHash, mac);
         written = { version: AUDIT_VERSION, previousHash, payloadHash, mac, recordHash, payload };
         await mkdir(path.dirname(filePath), { recursive: true });
-        await appendFile(filePath, `${JSON.stringify(written)}\n`, { encoding: 'utf8', mode: 0o600 });
+        // A successful record() is the mutation gate for security-sensitive
+        // operations. Resolve only after the JSONL record is on stable storage.
+        await appendDurably(filePath, `${JSON.stringify(written)}\n`);
         current.push(written);
         seal.headHash = recordHash;
         seal.recordCount = current.length;

package/src/server.js

@@ -814,17 +814,41 @@ function requestAuditHash(value) {
   }
 }
 
-function recordSecurityAudit(event = {}) {
-  if (!securityAuditStore) return;
+function securityAuditEvent(event = {}) {
   const runtime = runtimeManager.getSnapshot();
-  void securityAuditStore.record({
+  return {
     actorAccountId: event.actorAccountId || runtime.userId || '',
     actorUserId: event.actorUserId || runtime.userId || '',
     hubId: event.hubId || runtime.deviceId || '',
     ...event
-  }).catch(error => {
+  };
+}
+
+function markSecurityAuditFailed(error) {
+  if (securityAuditHealthy) {
     securityAuditHealthy = false;
     console.error(`[LiveDesk Hub] SECURITY AUDIT FAILURE: ${error?.message || error}`);
+  }
+}
+
+async function recordSecurityAuditRequired(event = {}) {
+  if (!securityAuditStore || !securityAuditHealthy) {
+    const error = new Error('security-audit-unavailable');
+    error.code = 'security-audit-unavailable';
+    throw error;
+  }
+  try {
+    return await securityAuditStore.record(securityAuditEvent(event));
+  } catch (error) {
+    markSecurityAuditFailed(error);
+    throw error;
+  }
+}
+
+function recordSecurityAudit(event = {}) {
+  void recordSecurityAuditRequired(event).catch(() => {
+    // Required mutation paths await recordSecurityAuditRequired directly.
+    // Best-effort lifecycle telemetry still marks the global audit gate failed.
   });
 }
 
@@ -1519,12 +1543,16 @@ async function synchronizeAgentEnablement() {
   return enabled;
 }
 
-const hubFilesystem = createHubFilesystem();
+const hubFilesystem = createHubFilesystem();
+const fileTransferCommandAckTimeoutMs = readPositiveIntegerEnv(
+  'LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS',
+  30_000
+);
 hubTransferJobs = createHubTransferJobs({
   filesystem: hubFilesystem,
   remoteHub,
   maxConcurrent: Number(process.env.LIVEDESK_MAX_FILE_JOBS || 2),
-  commandResultTimeoutMs: readPositiveIntegerEnv('LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS', 30_000),
+  commandResultTimeoutMs: fileTransferCommandAckTimeoutMs,
   getMaxFileSizeBytes: () => Number(
     liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
     || 1024 * 1024 * 1024)
@@ -1677,7 +1705,7 @@ app.use((req, res, next) => {
   }
   const mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
   const sensitiveRead = req.method === 'GET'
-    && ['/api/security/audit', '/api/privacy/inventory'].includes(req.path);
+    && ['/api/security/audit', '/api/security/rendezvous-issuer', '/api/privacy/inventory'].includes(req.path);
   if (!mutating && !sensitiveRead) {
     next();
     return;
@@ -1713,7 +1741,58 @@ app.use((req, res, next) => {
     return;
   }
   req.liveDeskAdminSessionId = localAdminSessionId;
-  next();
+  if (!mutating) {
+    next();
+    return;
+  }
+
+  const mutationRequestHash = requestAuditHash({ method: req.method, path: req.path });
+  void recordSecurityAuditRequired({
+    action: 'local-admin.mutation',
+    phase: 'accepted',
+    result: 'accepted',
+    sessionId: localAdminSessionId,
+    requestHash: mutationRequestHash,
+    authMethod: 'local-admin-session',
+    details: { method: req.method, path: req.path }
+  }).then(() => {
+    const originalEnd = res.end.bind(res);
+    let completionStarted = false;
+    res.end = (...args) => {
+      if (completionStarted) return res;
+      completionStarted = true;
+      const statusCode = Number(res.statusCode || 200);
+      void recordSecurityAuditRequired({
+        action: 'local-admin.mutation',
+        phase: 'complete',
+        result: statusCode >= 200 && statusCode < 400 ? 'success' : 'rejected',
+        reason: statusCode >= 400 ? `http-${statusCode}` : '',
+        sessionId: localAdminSessionId,
+        requestHash: mutationRequestHash,
+        authMethod: 'local-admin-session',
+        details: { method: req.method, path: req.path, statusCode }
+      }).then(() => {
+        originalEnd(...args);
+      }).catch(error => {
+        if (res.headersSent) {
+          res.destroy(error);
+          return;
+        }
+        const callback = [...args].reverse().find(value => typeof value === 'function');
+        const body = JSON.stringify({ ok: false, error: 'security-audit-unavailable' });
+        res.statusCode = 503;
+        res.removeHeader('Content-Length');
+        res.removeHeader('Transfer-Encoding');
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.setHeader('Content-Length', Buffer.byteLength(body));
+        originalEnd(body, 'utf8', callback);
+      });
+      return res;
+    };
+    next();
+  }).catch(() => {
+    res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
+  });
 });
 app.use(express.json({ limit: '32mb' }));
 app.use((req, res, next) => {
@@ -4247,6 +4326,19 @@ app.get('/api/security/trusted-devices', (_req, res) => {
   res.json({ ok: true, devices });
 });
 
+app.get('/api/security/rendezvous-issuer', (_req, res) => {
+  noStore(res);
+  const security = remoteHub.getSecurityStatus();
+  res.json({
+    ok: true,
+    hubId: security.hubId,
+    issuerKeyId: security.hubIssuerKeyId,
+    publicKey: security.hubPublicKey,
+    algorithm: 'P-256/SHA-256',
+    environmentVariable: 'LIVEDESK_UDP_RENDEZVOUS_TRUSTED_ISSUER_PUBLIC_KEYS'
+  });
+});
+
 app.get('/api/security/audit', async (req, res) => {
   noStore(res);
   try {
@@ -5479,11 +5571,37 @@ app.post('/api/remote/files/from-hub', requireHubFeatureAccess, (req, res) => {
       res.status(400).json({ ok: false, error: 'no-filesystem-items-selected' });
       return;
     }
-    const job = hubTransferJobs.create({
-      itemIds,
-      deviceIds,
-      remoteDirectory: req.body?.remoteDirectory
-    });
+    const job = hubTransferJobs.create({
+      itemIds,
+      deviceIds,
+      remoteDirectory: req.body?.remoteDirectory,
+      onComplete: async ({ completed, job: completedJob }) => {
+        await recordSecurityAuditRequired({
+          action: 'remote.file.job',
+          phase: 'complete',
+          result: completed ? 'success' : 'failed',
+          reason: completed ? '' : completedJob?.error || 'file-transfer-failed',
+          deviceIds,
+          sessionId: completedJob?.jobId || '',
+          requestHash: requestAuditHash({
+            jobId: completedJob?.jobId || '',
+            deviceIds,
+            remoteDirectory: req.body?.remoteDirectory || ''
+          }),
+          authMethod: 'local-admin-session',
+          details: {
+            state: completedJob?.state || '',
+            totalFiles: Number(completedJob?.totalFiles || 0),
+            completedFiles: Number(completedJob?.completedFiles || 0),
+            totalBytes: Number(completedJob?.totalBytes || 0),
+            sentBytes: Number(completedJob?.sentBytes || 0),
+            failedTargets: Array.isArray(completedJob?.failedTargets)
+              ? completedJob.failedTargets.length
+              : 0
+          }
+        });
+      }
+    });
     res.status(202).json({ ok: true, jobId: job.jobId, state: job.state });
   } catch (error) {
     sendFilesystemError(res, error);
@@ -5564,7 +5682,7 @@ app.post('/api/remote/filesystem/shared-folders/:folderId/sync', requireHubFeatu
   }
 });
 
-app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
+app.post('/api/remote/files/transfer', requireHubFeatureAccess, async (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
   if (deviceIds.length === 0) {
@@ -5581,44 +5699,53 @@ app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  const results = deviceIds.map(deviceId => ({
-    deviceId,
-    ...remoteHub.sendCommand(deviceId, {
-      command: 'file.transfer',
-      payload: {
-        transferId,
-        remoteDirectory,
-        files: normalized.files,
-        totalBytes: normalized.totalBytes,
-        requestedAt: queuedAt
-      }
-    })
-  }));
-  const queued = results.filter(result => result.ok).length;
-  recordSecurityAudit({
-    action: 'remote.file.transfer',
-    phase: 'start',
-    result: queued > 0 ? 'queued' : 'rejected',
-    reason: queued > 0 ? '' : 'no-transfer-queued',
-    deviceIds,
-    sessionId: transferId,
-    requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
-    authMethod: 'local-admin-session',
-    details: { queued, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
-  });
-  res.json({
-    ok: queued > 0,
-    transferId,
-    queued,
-    total: deviceIds.length,
-    totalBytes: normalized.totalBytes,
-    files: normalized.files.length,
-    results,
-    error: queued > 0 ? undefined : 'no-transfer-queued'
-  });
-});
-
-app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
+  try {
+    const results = await Promise.all(deviceIds.map(async deviceId => ({
+      deviceId,
+      ...await remoteHub.sendCommandAwaitResult(deviceId, {
+        command: 'file.transfer',
+        payload: {
+          transferId,
+          remoteDirectory,
+          files: normalized.files,
+          totalBytes: normalized.totalBytes,
+          requestedAt: queuedAt
+        }
+      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
+    })));
+    const queued = results.filter(result => result.queued).length;
+    const acknowledged = results.filter(result => result.acknowledged).length;
+    const success = acknowledged === deviceIds.length;
+    const partial = acknowledged > 0 && !success;
+    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
+    await recordSecurityAuditRequired({
+      action: 'remote.file.transfer',
+      phase: 'complete',
+      result: success ? 'success' : partial ? 'partial' : 'rejected',
+      reason: error || '',
+      deviceIds,
+      sessionId: transferId,
+      requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
+      authMethod: 'local-admin-session',
+      details: { queued, acknowledged, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
+    });
+    res.json({
+      ok: success,
+      transferId,
+      queued,
+      acknowledged,
+      total: deviceIds.length,
+      totalBytes: normalized.totalBytes,
+      files: normalized.files.length,
+      results,
+      error
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
+
+app.post('/api/remote/files/chunk', requireHubFeatureAccess, async (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
   if (deviceIds.length === 0) {
@@ -5636,42 +5763,51 @@ app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  const results = deviceIds.map(deviceId => ({
-    deviceId,
-    ...remoteHub.sendCommand(deviceId, {
-      command: 'file.transfer.chunk',
-      payload: {
-        transferId,
-        remoteDirectory,
-        ...normalized.chunk,
-        requestedAt: queuedAt
-      }
-    })
-  }));
-  const queued = results.filter(result => result.ok).length;
-  recordSecurityAudit({
-    action: 'remote.file.chunk',
-    phase: normalized.chunk.final ? 'complete' : 'progress',
-    result: queued > 0 ? 'queued' : 'rejected',
-    reason: queued > 0 ? '' : 'no-transfer-queued',
-    deviceIds,
-    sessionId: transferId,
-    requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
-    authMethod: 'local-admin-session',
-    details: { queued, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
-  });
-  res.json({
-    ok: queued > 0,
-    transferId,
-    queued,
-    total: deviceIds.length,
-    byteLength: normalized.chunk.byteLength,
-    offset: normalized.chunk.offset,
-    final: normalized.chunk.final,
-    results,
-    error: queued > 0 ? undefined : 'no-transfer-queued'
-  });
-});
+  try {
+    const results = await Promise.all(deviceIds.map(async deviceId => ({
+      deviceId,
+      ...await remoteHub.sendCommandAwaitResult(deviceId, {
+        command: 'file.transfer.chunk',
+        payload: {
+          transferId,
+          remoteDirectory,
+          ...normalized.chunk,
+          requestedAt: queuedAt
+        }
+      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
+    })));
+    const queued = results.filter(result => result.queued).length;
+    const acknowledged = results.filter(result => result.acknowledged).length;
+    const success = acknowledged === deviceIds.length;
+    const partial = acknowledged > 0 && !success;
+    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
+    await recordSecurityAuditRequired({
+      action: 'remote.file.chunk',
+      phase: normalized.chunk.final ? 'complete' : 'progress',
+      result: success ? 'success' : partial ? 'partial' : 'rejected',
+      reason: error || '',
+      deviceIds,
+      sessionId: transferId,
+      requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
+      authMethod: 'local-admin-session',
+      details: { queued, acknowledged, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
+    });
+    res.json({
+      ok: success,
+      transferId,
+      queued,
+      acknowledged,
+      total: deviceIds.length,
+      byteLength: normalized.chunk.byteLength,
+      offset: normalized.chunk.offset,
+      final: normalized.chunk.final,
+      results,
+      error
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
 
 const MANUAL_POWER_ACTIONS = new Set(['lock', 'sleep', 'restart', 'shutdown']);
 
@@ -5990,11 +6126,37 @@ httpServer.on('upgrade', (req, socket, head) => {
     socket.destroy();
     return;
   }
-  try {
-    const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
-    if (parsed.pathname === '/api/remote/frames/ws') {
-      frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
-      return;
+  let parsed;
+  try {
+    parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
+  } catch {
+    socket.write('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  const websocketPath = parsed.pathname;
+  if (![
+    '/api/remote/frames/ws',
+    '/api/remote/atlas/ws',
+    '/api/remote/input/ws',
+    '/api/remote/audio/ws'
+  ].includes(websocketPath)) {
+    socket.write('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  void recordSecurityAuditRequired({
+    action: 'local-admin.websocket',
+    phase: 'accepted',
+    result: 'accepted',
+    sessionId: localAdminSessionId,
+    requestHash: requestAuditHash({ path: websocketPath }),
+    authMethod: 'local-admin-websocket',
+    details: { path: websocketPath }
+  }).then(() => {
+    if (parsed.pathname === '/api/remote/frames/ws') {
+      frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
+      return;
     }
     if (parsed.pathname === '/api/remote/atlas/ws') {
       atlasWss.handleUpgrade(req, socket, head, ws => atlasWss.emit('connection', ws, req));
@@ -6005,16 +6167,14 @@ httpServer.on('upgrade', (req, socket, head) => {
       return;
     }
     if (parsed.pathname === '/api/remote/audio/ws') {
-      audioWss.handleUpgrade(req, socket, head, ws => audioWss.emit('connection', ws, req));
-      return;
-    }
-    socket.write('HTTP/1.1 404 Not Found\r\n\r\n');
-    socket.destroy();
-  } catch {
-    socket.write('HTTP/1.1 400 Bad Request\r\n\r\n');
-    socket.destroy();
-  }
-});
+      audioWss.handleUpgrade(req, socket, head, ws => audioWss.emit('connection', ws, req));
+      return;
+    }
+  }).catch(() => {
+    socket.write('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+  });
+});
 
 frameWss.on('connection', (ws, req) => {
   frameClients.add(ws);
@@ -6127,23 +6287,21 @@ audioWss.on('connection', (ws, req) => {
 });
 
 inputWss.on('connection', ws => {
-  inputClients.add(ws);
-  ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
+  inputClients.add(ws);
+  ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
   ws.liveDeskInputDeviceIds = new Set();
-  recordSecurityAudit({
-    action: 'remote.control.browser-session',
-    phase: 'start',
-    result: 'success',
-    sessionId: ws.liveDeskInputClientId,
-    authMethod: 'local-admin-websocket'
-  });
+  ws.liveDeskInputAuditReady = false;
   try {
     ws._socket?.setNoDelay?.(true);
   } catch {
     // Best-effort latency hint for browser input sockets.
-  }
-  ws.on('message', data => {
-    let payload;
+  }
+  ws.on('message', data => {
+    if (ws.liveDeskInputAuditReady !== true) {
+      sendJson(ws, { type: 'RemoteInputError', error: 'security-audit-pending' });
+      return;
+    }
+    let payload;
     try {
       payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
     } catch {
@@ -6189,7 +6347,7 @@ inputWss.on('connection', ws => {
     for (const deviceId of ws.liveDeskInputDeviceIds || []) {
       remoteHub.releaseInputOwner(deviceId, ws.liveDeskInputClientId, reason);
     }
-    recordSecurityAudit({
+    void recordSecurityAuditRequired({
       action: 'remote.control.browser-session',
       phase: 'complete',
       result: 'success',
@@ -6197,18 +6355,31 @@ inputWss.on('connection', ws => {
       deviceIds: [...(ws.liveDeskInputDeviceIds || [])],
       sessionId: ws.liveDeskInputClientId,
       authMethod: 'local-admin-websocket'
+    }).catch(() => {
+      // The global fail-closed gate is marked by recordSecurityAuditRequired.
     });
-    ws.liveDeskInputDeviceIds?.clear?.();
-  };
-  ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
-  ws.on('error', () => releaseBrowserInputOwner('browser-input-websocket-error'));
-  sendJson(ws, {
-    type: 'RemoteInputSocketReady',
-    protocol: 'livedesk.remote.input.json.v1',
-    clientId: ws.liveDeskInputClientId,
-    timestamp: new Date().toISOString()
-  });
-});
+    ws.liveDeskInputDeviceIds?.clear?.();
+  };
+  ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
+  ws.on('error', () => releaseBrowserInputOwner('browser-input-websocket-error'));
+  void recordSecurityAuditRequired({
+    action: 'remote.control.browser-session',
+    phase: 'start',
+    result: 'success',
+    sessionId: ws.liveDeskInputClientId,
+    authMethod: 'local-admin-websocket'
+  }).then(() => {
+    ws.liveDeskInputAuditReady = true;
+    sendJson(ws, {
+      type: 'RemoteInputSocketReady',
+      protocol: 'livedesk.remote.input.json.v1',
+      clientId: ws.liveDeskInputClientId,
+      timestamp: new Date().toISOString()
+    });
+  }).catch(() => {
+    ws.close(1011, 'security-audit-unavailable');
+  });
+});
 
 await remoteHub.start();
 connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);

package/src/transport/relay-hub-control.js

@@ -1029,8 +1029,9 @@ export function createHubRelayControl({
                     throw relayError('secure-enrollment-proof-invalid');
                 }
                 verifyP256Signature(devicePublic.key, clientTranscript, message.deviceSignature);
+                authority.assertEnrollmentAllowed?.({ accountId, deviceId, devicePublicKey: devicePublic.text });
                 if (!secureSession.consumeEnrollmentToken?.(enrollmentSecret)) throw relayError('secure-enrollment-token-used');
-                issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text, replace: true });
+                issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text });
             } else {
                 const verified = authority.verifyCredential(message.credential, { accountId, deviceId });
                 if (verified.payload.devicePublicKey !== devicePublic.text) throw relayError('device-credential-binding-invalid');

package/src/transport/secure-direct-acceptor.js

@@ -237,8 +237,9 @@ export function createSecureDirectAcceptor({
         throw directError('secure-enrollment-proof-invalid');
       }
       verifyP256Signature(devicePublic.key, clientTranscript, hello.deviceSignature);
+      authority.assertEnrollmentAllowed?.({ accountId, deviceId, devicePublicKey: devicePublic.text });
       if (!consumeEnrollmentToken(token)) throw directError('secure-enrollment-token-used');
-      const issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text, replace: true });
+      const issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text });
       credential = issued.credential;
       credentialPayload = issued.payload;
       enrollmentCount += 1;

package/src/transport/udp-hub-transport.js

@@ -441,12 +441,23 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             udpSessionId = crypto.randomUUID();
             routeKey = udpSessionRouteKey(udpSessionId);
         } while (sessionsByRouteKey.has(routeKey));
-        const proof = typeof rendezvousProofIssuer === 'function'
-            ? rendezvousProofIssuer({ roomId: udpSessionId, deviceId: id, ttlMs: 60_000 })
+        const hubProof = typeof rendezvousProofIssuer === 'function'
+            ? rendezvousProofIssuer({ roomId: udpSessionId, deviceId: id, role: 'hub', ttlMs: 60_000 })
             : null;
-        const signedRendezvousProof = safeText(proof?.proof, 2048);
+        const clientProof = typeof rendezvousProofIssuer === 'function'
+            ? rendezvousProofIssuer({ roomId: udpSessionId, deviceId: id, role: 'client', ttlMs: 60_000 })
+            : null;
+        const signedHubRendezvousProof = safeText(hubProof?.proof, 2048);
+        const signedClientRendezvousProof = safeText(clientProof?.proof, 2048);
         const allowLegacyUnsignedProofForTests = env.LIVEDESK_TEST_MODE === '1'
             || env.LIVEDESK_TEST_ALLOW_LEGACY_UDP_RENDEZVOUS === '1';
+        const legacyRendezvousToken = allowLegacyUnsignedProofForTests
+            && (!signedHubRendezvousProof || !signedClientRendezvousProof)
+            ? crypto.randomBytes(16).toString('hex')
+            : '';
+        const proofExpiries = [hubProof?.payload?.expiresAt, clientProof?.payload?.expiresAt]
+            .map(Number)
+            .filter(Number.isSafeInteger);
         const session = {
             deviceId: id,
             tcpSessionId: safeText(tcpSessionId, 160),
@@ -455,9 +466,9 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             routeKey,
             key,
             keyBase64: key.toString('base64'),
-            rendezvousToken: signedRendezvousProof
-                || (allowLegacyUnsignedProofForTests ? crypto.randomBytes(16).toString('hex') : ''),
-            rendezvousProofExpiresAt: Number(proof?.payload?.expiresAt || 0),
+            rendezvousToken: signedHubRendezvousProof || legacyRendezvousToken,
+            clientRendezvousToken: signedClientRendezvousProof || legacyRendezvousToken,
+            rendezvousProofExpiresAt: proofExpiries.length === 2 ? Math.min(...proofExpiries) : 0,
             sendControl,
             clientEndpoint: null,
             peerEndpoint: null,
@@ -493,8 +504,8 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             frameChunkHeader: UDP_FRAME_CHUNK_PROTOCOL,
             frameTimeoutMs,
             maxPendingFrames,
-            rendezvous: rendezvousHost && session.rendezvousToken
-                ? { host: rendezvousHost, port: rendezvousPort, roomId: session.sessionId, token: session.rendezvousToken }
+            rendezvous: rendezvousHost && session.clientRendezvousToken
+                ? { host: rendezvousHost, port: rendezvousPort, roomId: session.sessionId, token: session.clientRendezvousToken }
                 : null
         });
         sendRendezvousRegister(session);

package/src/transport/udp-rendezvous.js

@@ -62,20 +62,52 @@ function decodeCanonicalBase64Url(value, minimum, maximum = minimum) {
         : null;
 }
 
-function verifyRendezvousProof(proof, roomId, current) {
+function trustedIssuerMap(values) {
+    const entries = Array.isArray(values)
+        ? values
+        : String(values || '').split(/[\s,]+/u).filter(Boolean);
+    if (entries.length > 10_000) throw new Error('udp-rendezvous-trusted-issuer-capacity');
+    const issuers = new Map();
+    for (const entry of entries) {
+        const publicKeyBytes = decodeCanonicalBase64Url(entry, 80, 160);
+        if (!publicKeyBytes) throw new Error('udp-rendezvous-trusted-issuer-invalid');
+        let publicKey;
+        try {
+            publicKey = crypto.createPublicKey({ key: publicKeyBytes, format: 'der', type: 'spki' });
+        } catch {
+            throw new Error('udp-rendezvous-trusted-issuer-invalid');
+        }
+        if (publicKey.asymmetricKeyType !== 'ec'
+            || publicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
+            throw new Error('udp-rendezvous-trusted-issuer-invalid');
+        }
+        const keyId = crypto.createHash('sha256').update(publicKeyBytes).digest('base64url');
+        issuers.set(keyId, publicKey);
+    }
+    return issuers;
+}
+
+function exactSafeText(value, maximum) {
+    return typeof value === 'string' && value.length > 0 && safeText(value, maximum) === value;
+}
+
+function verifyRendezvousProof(proof, roomId, role, current, trustedIssuers) {
     try {
         const parts = String(proof || '').split('.');
-        if (parts.length !== 2) return false;
+        if (parts.length !== 2) return { ok: false, reason: 'invalid-proof' };
         const payloadBytes = decodeCanonicalBase64Url(parts[0], 64, 1536);
         const signature = decodeCanonicalBase64Url(parts[1], 64, 64);
-        if (!payloadBytes || !signature) return false;
+        if (!payloadBytes || !signature) return { ok: false, reason: 'invalid-proof' };
         const payload = JSON.parse(payloadBytes.toString('utf8'));
-        if (!payload || payload.version !== 1
-            || payload.protocol !== 'livedesk.udp.rendezvous-proof.v1'
+        if (!payload || payload.version !== 2
+            || payload.protocol !== 'livedesk.udp.rendezvous-proof.v2'
             || payload.roomId !== roomId
-            || !safeText(payload.accountId, 128)
-            || !safeText(payload.hubId, 128)
-            || !safeText(payload.deviceId, 128)
+            || !exactSafeText(payload.issuerKeyId, 64)
+            || !exactSafeText(payload.roomId, 160)
+            || !exactSafeText(payload.role, 16)
+            || !exactSafeText(payload.accountId, 128)
+            || !exactSafeText(payload.hubId, 128)
+            || !exactSafeText(payload.deviceId, 128)
             || !Number.isSafeInteger(payload.issuedAt)
             || !Number.isSafeInteger(payload.expiresAt)
             || payload.issuedAt > current + 30_000
@@ -83,19 +115,26 @@ function verifyRendezvousProof(proof, roomId, current) {
             || payload.expiresAt <= payload.issuedAt
             || payload.expiresAt - payload.issuedAt > 120_000
             || !decodeCanonicalBase64Url(payload.nonce, 16, 32)) {
-            return false;
+            return { ok: false, reason: 'invalid-proof' };
         }
-        const hubPublicBytes = decodeCanonicalBase64Url(payload.hubPublicKey, 80, 160);
-        if (!hubPublicBytes) return false;
-        const hubKey = crypto.createPublicKey({ key: hubPublicBytes, format: 'der', type: 'spki' });
-        return hubKey.asymmetricKeyType === 'ec'
-            && hubKey.asymmetricKeyDetails?.namedCurve === 'prime256v1'
-            && crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), {
-                key: hubKey,
+        if (payload.role !== role) return { ok: false, reason: 'role-mismatch' };
+        const issuerKeyIdBytes = decodeCanonicalBase64Url(payload.issuerKeyId, 32, 32);
+        if (!issuerKeyIdBytes) return { ok: false, reason: 'invalid-proof' };
+        const issuerKey = trustedIssuers.get(payload.issuerKeyId);
+        if (!issuerKey) return { ok: false, reason: 'untrusted-issuer' };
+        const valid = crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), {
+                key: issuerKey,
                 dsaEncoding: 'ieee-p1363'
             }, signature);
+        if (!valid) return { ok: false, reason: 'invalid-signature' };
+        return {
+            ok: true,
+            payload,
+            proofKey: `${payload.issuerKeyId}:${payload.nonce}:${payload.roomId}:${payload.role}`,
+            proofHash: crypto.createHash('sha256').update(String(proof), 'utf8').digest('base64url')
+        };
     } catch {
-        return false;
+        return { ok: false, reason: 'invalid-proof' };
     }
 }
 
@@ -116,6 +155,7 @@ export function createUdpRendezvousServer({
     perSourceBurst = DEFAULT_LIMITS.perSourceBurst,
     globalRate = DEFAULT_LIMITS.globalRate,
     globalBurst = DEFAULT_LIMITS.globalBurst,
+    trustedIssuerPublicKeys = [],
     allowLegacyTokens = false
 } = {}) {
     const socket = dgram.createSocket('udp4');
@@ -123,12 +163,15 @@ export function createUdpRendezvousServer({
     const unpairedRooms = new Map();
     const sources = new Map();
     const evictableSources = new Map();
+    const consumedProofs = new Map();
+    const trustedIssuers = trustedIssuerMap(trustedIssuerPublicKeys);
     const limits = Object.freeze({
         roomTtlMs: normalizeInteger(roomTtlMs, DEFAULT_LIMITS.roomTtlMs),
         sourceTtlMs: normalizeInteger(sourceTtlMs, DEFAULT_LIMITS.sourceTtlMs),
         sweepIntervalMs: normalizeInteger(sweepIntervalMs, DEFAULT_LIMITS.sweepIntervalMs),
         statusIntervalMs: normalizeInteger(statusIntervalMs, DEFAULT_LIMITS.statusIntervalMs, 0),
         maxRooms: normalizeInteger(maxRooms, DEFAULT_LIMITS.maxRooms),
+        maxConsumedProofs: Math.min(200_000, normalizeInteger(maxRooms, DEFAULT_LIMITS.maxRooms) * 2),
         maxSources: normalizeInteger(maxSources, DEFAULT_LIMITS.maxSources),
         maxRoomsPerSource: normalizeInteger(maxRoomsPerSource, DEFAULT_LIMITS.maxRoomsPerSource),
         perSourceRate: normalizeRate(perSourceRate, DEFAULT_LIMITS.perSourceRate),
@@ -151,6 +194,13 @@ export function createUdpRendezvousServer({
         sourceRoomLimitDrops: 0,
         roomCapacityDrops: 0,
         tokenMismatchDrops: 0,
+        untrustedIssuerDrops: 0,
+        roleMismatchDrops: 0,
+        bindingMismatchDrops: 0,
+        proofReplayDrops: 0,
+        endpointOverwriteDrops: 0,
+        idempotentRefreshes: 0,
+        proofCapacityDrops: 0,
         expiredRooms: 0,
         evictedRooms: 0,
         expiredSources: 0,
@@ -194,6 +244,9 @@ export function createUdpRendezvousServer({
         for (const [roomId, room] of rooms) {
             if (at - room.updatedAt >= limits.roomTtlMs) deleteRoom(roomId, 'expired');
         }
+        for (const [proofKey, consumed] of consumedProofs) {
+            if (consumed.expiresAt <= at) consumedProofs.delete(proofKey);
+        }
         for (const [key, source] of sources) {
             if (source.activeRooms === 0 && at - source.lastSeenAt >= limits.sourceTtlMs) {
                 sources.delete(key);
@@ -259,7 +312,7 @@ export function createUdpRendezvousServer({
         });
     }
 
-    function createRoom(roomId, token, source, at) {
+    function createRoom(roomId, binding, source, at, legacyToken = '') {
         if (source.activeRooms >= limits.maxRoomsPerSource) {
             counters.sourceRoomLimitDrops += 1;
             return null;
@@ -274,7 +327,8 @@ export function createUdpRendezvousServer({
             }
         }
         const room = {
-            token,
+            legacyToken,
+            binding,
             ownerSource: source.key,
             peers: new Map(),
             createdAt: at,
@@ -317,8 +371,13 @@ export function createUdpRendezvousServer({
             counters.invalidDatagrams += 1;
             return;
         }
-        if (!allowLegacyTokens && !verifyRendezvousProof(token, roomId, at)) {
+        const verification = allowLegacyTokens
+            ? { ok: true, legacy: true, token }
+            : verifyRendezvousProof(token, roomId, role, at, trustedIssuers);
+        if (!verification.ok) {
             counters.invalidDatagrams += 1;
+            if (verification.reason === 'untrusted-issuer') counters.untrustedIssuerDrops += 1;
+            if (verification.reason === 'role-mismatch') counters.roleMismatchDrops += 1;
             return;
         }
         let room = rooms.get(roomId);
@@ -326,16 +385,64 @@ export function createUdpRendezvousServer({
             deleteRoom(roomId, 'expired');
             room = null;
         }
-        if (room && room.token !== token) {
-            counters.tokenMismatchDrops += 1;
-            return;
-        }
-        if (!room) {
-            room = createRoom(roomId, token, source, at);
-            if (!room) return;
+        if (verification.legacy) {
+            if (room && room.legacyToken !== token) {
+                counters.tokenMismatchDrops += 1;
+                return;
+            }
+            if (!room) {
+                room = createRoom(roomId, null, source, at, token);
+                if (!room) return;
+            }
+            room.updatedAt = at;
+            room.peers.set(role, { address: rinfo.address, port: rinfo.port });
+        } else {
+            const binding = {
+                issuerKeyId: verification.payload.issuerKeyId,
+                accountId: verification.payload.accountId,
+                hubId: verification.payload.hubId,
+                deviceId: verification.payload.deviceId
+            };
+            if (room && JSON.stringify(room.binding) !== JSON.stringify(binding)) {
+                counters.bindingMismatchDrops += 1;
+                return;
+            }
+            const endpoint = { address: rinfo.address, port: rinfo.port };
+            const consumed = consumedProofs.get(verification.proofKey);
+            const existingPeer = room?.peers.get(role);
+            if (consumed) {
+                const sameEndpoint = consumed.address === endpoint.address && consumed.port === endpoint.port;
+                const sameOwner = existingPeer?.proofKey === verification.proofKey
+                    && existingPeer.address === endpoint.address
+                    && existingPeer.port === endpoint.port;
+                if (sameEndpoint && sameOwner) {
+                    room.updatedAt = at;
+                    counters.idempotentRefreshes += 1;
+                    return;
+                }
+                counters.proofReplayDrops += 1;
+                if (existingPeer && !sameEndpoint) counters.endpointOverwriteDrops += 1;
+                return;
+            }
+            if (consumedProofs.size >= limits.maxConsumedProofs) {
+                counters.proofCapacityDrops += 1;
+                return;
+            }
+            if (existingPeer) {
+                counters.endpointOverwriteDrops += 1;
+                return;
+            }
+            if (!room) {
+                room = createRoom(roomId, binding, source, at);
+                if (!room) return;
+            }
+            room.updatedAt = at;
+            room.peers.set(role, { ...endpoint, proofKey: verification.proofKey, proofHash: verification.proofHash });
+            consumedProofs.set(verification.proofKey, {
+                ...endpoint,
+                expiresAt: verification.payload.expiresAt
+            });
         }
-        room.updatedAt = at;
-        room.peers.set(role, { address: rinfo.address, port: rinfo.port });
         counters.acceptedRegistrations += 1;
         if (room.peers.size < 2) {
             unpairedRooms.delete(roomId);
@@ -391,6 +498,9 @@ export function createUdpRendezvousServer({
             unpairedRooms: unpairedRooms.size,
             sources: sources.size,
             evictableSources: evictableSources.size,
+            consumedProofs: consumedProofs.size,
+            trustedIssuerCount: trustedIssuers.size,
+            securityReady: allowLegacyTokens || trustedIssuers.size > 0,
             limits: { ...limits },
             counters: { ...counters },
             lastError
@@ -419,6 +529,9 @@ export function createUdpRendezvousServer({
 
     async function start() {
         if (started) return { host, port: boundPort };
+        if (!allowLegacyTokens && trustedIssuers.size === 0) {
+            throw new Error('udp-rendezvous-trusted-issuer-required');
+        }
         await new Promise((resolve, reject) => {
             const onError = error => { socket.off('listening', onListening); reject(error); };
             const onListening = () => { socket.off('error', onError); resolve(); };
@@ -443,6 +556,7 @@ export function createUdpRendezvousServer({
         unpairedRooms.clear();
         sources.clear();
         evictableSources.clear();
+        consumedProofs.clear();
         if (started) {
             await new Promise(resolve => socket.close(() => resolve()));
             started = false;