ciphermesh 2.11.0 → 2.13.0

package/src/crypto/TrustStore.js

@@ -9,6 +9,9 @@ const TRUST_FILE = 'trusted-peers.json';
 export const TrustResult = {
   NEW_PEER: 'new_peer',
   TRUSTED: 'trusted',
+  // A key that is not the one on the record, but that the identity bound to
+  // this record has signed as another of its devices. Not a mismatch.
+  KNOWN_DEVICE: 'known_device',
   MISMATCH: 'mismatch',
   VERIFIED_MISMATCH: 'verified_mismatch',
 };
@@ -75,6 +78,18 @@ export class TrustStore {
 
     // Compare the FULL public key (256 bits), not the 64-bit fingerprint.
     // Fall back to the fingerprint only for legacy records without publicKey.
+    // Once a synced device list exists, it is the authority on which keys are
+    // this person — including about the key the record was built on. A revoked
+    // primary that stayed TRUSTED here would make revocation decorative.
+    if (Array.isArray(record.devices)) {
+      if (record.devices.includes(publicKeyB64)) {
+        record.lastSeen = Date.now();
+        this.#save();
+        return record.publicKey === publicKeyB64 ? TrustResult.TRUSTED : TrustResult.KNOWN_DEVICE;
+      }
+      return record.verified ? TrustResult.VERIFIED_MISMATCH : TrustResult.MISMATCH;
+    }
+
     const matches = record.publicKey
       ? record.publicKey === publicKeyB64
       : record.fingerprint === KeyManager.computeFingerprint(Buffer.from(publicKeyB64, 'base64'));
@@ -85,6 +100,18 @@ export class TrustStore {
       return TrustResult.TRUSTED;
     }
 
+    // Another device of the same person is not a key that changed.
+    //
+    // Every key here was put there by a device list signed by the identity
+    // bound to this record — see syncDevices, which is the only writer. So this
+    // is not "a second key we have seen before", it is "a key the identity you
+    // verified says is also them".
+    if (record.devices?.includes(publicKeyB64)) {
+      record.lastSeen = Date.now();
+      this.#save();
+      return TrustResult.KNOWN_DEVICE;
+    }
+
     if (record.verified) {
       return TrustResult.VERIFIED_MISMATCH;
     }
@@ -173,6 +200,132 @@ export class TrustStore {
     return `${digits.slice(0, 4)} ${digits.slice(4, 8)} ${digits.slice(8)}`;
   }
 
+  /**
+   * The same construction over Ed25519 identity keys instead of box keys.
+   *
+   * A separate domain tag, not the same one with different inputs: two
+   * protocols that can produce the same digits from different material are two
+   * protocols one of them can be tricked into accepting. Same width, because
+   * the reason 40 bits replaced 20 has not changed.
+   *
+   * Only ever used when *both* sides will use it — see
+   * ChatController#identitySasReady. A pair where one side compares identity
+   * keys and the other compares box keys would show two different codes to two
+   * people who are doing everything right.
+   */
+  static computeIdentitySAS(myIdentityPk, peerIdentityPk) {
+    const mine = Buffer.isBuffer(myIdentityPk) ? myIdentityPk : Buffer.from(myIdentityPk, 'base64');
+    const theirs = Buffer.isBuffer(peerIdentityPk)
+      ? peerIdentityPk
+      : Buffer.from(peerIdentityPk, 'base64');
+
+    const [first, second] = Buffer.compare(mine, theirs) <= 0 ? [mine, theirs] : [theirs, mine];
+    const context = Buffer.from('CipherMesh-IdentitySAS-v1');
+    const hash = Buffer.alloc(32);
+    sodium.crypto_generichash(hash, Buffer.concat([first, second, context]));
+
+    let num = 0n;
+    for (let i = 0; i < 5; i++) {
+      num = (num << 8n) | BigInt(hash[i]);
+    }
+    const digits = num.toString().padStart(13, '0');
+    return `${digits.slice(0, 4)} ${digits.slice(4, 8)} ${digits.slice(8)}`;
+  }
+
+  /**
+   * Bind an identity key to a peer's record, keeping whatever verification the
+   * record already carries.
+   *
+   * This is the migration, and it is only ever called when the binding is
+   * provable: the identity signed a device list naming the box key this record
+   * was built on, and that list arrived over a channel only the holder of that
+   * box key could have written to. So the identity is vouched for by exactly
+   * the thing the user already verified out of band — the same reasoning
+   * `autoUpdatePeer` uses to carry verification across a key rotation.
+   *
+   * Nothing here can *create* verification. A record that was never verified is
+   * bound and stays unverified.
+   *
+   * @returns {'bound'|'unchanged'|'conflict'|'unknown'}
+   */
+  bindIdentity(nickname, identityPkB64) {
+    const record = this.#store.get(nickname.toLowerCase());
+    if (!record) {
+      return 'unknown';
+    }
+    if (record.identityPk === identityPkB64) {
+      return 'unchanged';
+    }
+    // A second identity claiming a record that already has one. Never silently
+    // overwritten: for a verified record this is the loud case, and it is the
+    // shape a takeover would have.
+    if (record.identityPk) {
+      return 'conflict';
+    }
+    record.identityPk = identityPkB64;
+    record.lastSeen = Date.now();
+    this.#save();
+    return 'bound';
+  }
+
+  /** The identity bound to a peer, or null. */
+  identityFor(nickname) {
+    return this.#store.get(nickname.toLowerCase())?.identityPk ?? null;
+  }
+
+  /**
+   * Set the device keys an identity has signed for to exactly this set.
+   *
+   * A replacement, not an accumulation, and that is the whole of revocation on
+   * the receiving side: a device that has been removed from the list stops
+   * being one of this person's keys here too. Accumulating would leave every
+   * revoked key trusted forever, which is worse than not having revocation at
+   * all, because it would look like it worked.
+   *
+   * The only writer of `record.devices`, and it refuses unless the identity
+   * asking is the one already bound to the record. Without that check any
+   * signed list could write keys onto anybody's record, which is the attack
+   * this prevents rather than enables.
+   *
+   * The record's primary `publicKey` is left alone even when the list no longer
+   * names it: it is the historical fact of what the user compared digits over.
+   * `checkPeer` stops honouring it, which is the part that matters.
+   *
+   * @returns {{added: string[], removed: string[]}}
+   */
+  syncDevices(nickname, identityPkB64, boxKeys) {
+    const record = this.#store.get(nickname.toLowerCase());
+    if (!record || !record.identityPk || record.identityPk !== identityPkB64) {
+      return { added: [], removed: [] };
+    }
+    const before = new Set(record.devices ?? []);
+    const after = new Set(boxKeys);
+
+    const added = [...after].filter((key) => !before.has(key));
+    const removed = [...before].filter((key) => !after.has(key));
+
+    if (added.length > 0 || removed.length > 0 || !record.devices) {
+      record.devices = [...after];
+      record.lastSeen = Date.now();
+      this.#save();
+    }
+    return { added, removed };
+  }
+
+  /**
+   * Every box key this peer is currently known by.
+   *
+   * Once a list has been synced it is the answer on its own; before that, the
+   * verified key is all there is.
+   */
+  devicesFor(nickname) {
+    const record = this.#store.get(nickname.toLowerCase());
+    if (!record) {
+      return [];
+    }
+    return record.devices ? [...record.devices] : [record.publicKey].filter(Boolean);
+  }
+
   markVerified(nickname) {
     const key = nickname.toLowerCase();
     const record = this.#store.get(key);

package/src/p2p/P2PChatController.js

@@ -47,6 +47,25 @@ import { COMMANDS } from '../client/UI.js';
 const TYPING_SEND_INTERVAL = 2000;
 const TYPING_EXPIRE_TIMEOUT = 3000;
 
+// Commands that exist only on the relay side, and why — so the mesh can say so
+// instead of guessing at a typo.
+//
+// `/device` is the interesting one. Multi-device is not merely unimplemented
+// here: a mesh peer is keyed by *nickname* (`#peers` above is
+// `Map<peerNickname, …>`) and has no session id, so two devices of one person
+// collide on the very thing the peer map is indexed by. Supporting them means
+// re-keying the mesh's whole model of who a peer is, which is a different
+// design from the relay's and deliberately out of scope — see
+// docs/design/multi-device.md.
+const RELAY_ONLY = {
+  '/device':
+    'In the mesh a peer is known by nickname, which is exactly what two of ' +
+    'your devices would share, so it is a different design and not built yet.',
+  '/create': 'Rooms with an owner exist only where there is a relay to hold one.',
+  '/invite': 'There is no address to invite anyone to without a relay.',
+  '/nick': 'Your name here is the one you started with; there is no registry to change it in.',
+};
+
 export class P2PChatController {
   #nickname;
   #connManager;
@@ -1996,6 +2015,7 @@ export class P2PChatController {
 
       case '/room':
         this.#ui.addInfoMessage(`Current room: #${this.#currentRoom}`);
+        this.#ui.addInfoMessage(`Sending: ${this.#describeSendPath()}`);
         break;
 
       case '/tips': {
@@ -2108,6 +2128,14 @@ export class P2PChatController {
             break;
           }
         }
+        // A relay-only command is not a typo, and guessing at one is worse than
+        // saying nothing: `/device` currently suggests `/voice`, which sends
+        // somebody looking in the wrong place entirely.
+        const relayOnly = RELAY_ONLY[cmd];
+        if (relayOnly) {
+          this.#ui.addErrorMessage(`${cmd} needs a relay. ${relayOnly}`);
+          return;
+        }
         const suggestion = suggestCommand(cmd, COMMANDS);
         const hint = suggestion ? ` Did you mean ${suggestion}?` : ' Use /help';
         this.#ui.addErrorMessage(`Unknown command: ${cmd}.${hint}`);
@@ -2375,6 +2403,51 @@ export class P2PChatController {
     this.#broadcastPayload(payload, false, toPeer, room);
   }
 
+  // Which path the next line you type will take, and what is holding it there.
+  //
+  // The mesh half of #481. The saving here is not frames — there is no relay to
+  // fan anything out, so a mesh sends one frame per peer either way — it is
+  // encryptions: one for the room, or one per peer. That is the cost the room
+  // silently pays when something has pushed it back onto the pairwise path, and
+  // until now nothing said so.
+  //
+  // The order matches the decision in #sendMessage, which is the only place
+  // that chooses. Two of the reasons are relay-side concerns that do not exist
+  // here (no hub to be older, no capability negotiation); one is a reason the
+  // relay does not have — constant cover paces messages through pairwise slots
+  // on purpose, because the timing guarantee is what it is for.
+  groupSendStatus() {
+    const inRoom = [...this.#peers.keys()].filter(
+      (nick) => (this.#peerRooms.get(nick) || 'general') === this.#currentRoom,
+    );
+    if (this.#deniableMode) {
+      return { group: false, reason: 'deniable', peers: inRoom.length };
+    }
+    if (this.#coverMode === 'constant') {
+      return { group: false, reason: 'cover', peers: inRoom.length };
+    }
+    if (inRoom.length === 0) {
+      return { group: false, reason: 'alone', peers: 0 };
+    }
+    return { group: true, reason: null, peers: inRoom.length };
+  }
+
+  #describeSendPath() {
+    const status = this.groupSendStatus();
+    if (status.group) {
+      return `one encryption for the room, sent to ${status.peers}`;
+    }
+    const cost = `${status.peers} encryption${status.peers === 1 ? '' : 's'} per message`;
+    switch (status.reason) {
+      case 'deniable':
+        return `${cost} — deniable mode is on, and deniability is pairwise`;
+      case 'cover':
+        return `${cost} — constant cover paces messages through pairwise slots`;
+      default:
+        return 'nothing yet — no one else is in this room';
+    }
+  }
+
   // Encrypt a room message ONCE and send the same ciphertext to every online
   // room peer — real group cryptography (O(1) encryption instead of O(N)).
   #sendRoomGroup(room, payload) {

package/src/protocol/messages.js

@@ -50,7 +50,22 @@ function base(type) {
 // post-quantum handshake. Absent = classical-only peer (pre-2.3 client).
 // caps (optional): what this client can do beyond the baseline protocol. Omitted
 // when empty so the wire is byte-identical to a pre-capability client.
-export function createJoin(nickname, publicKeyB64, pqPublicKeyB64 = null, caps = null) {
+// identityKey: the Ed25519 key a device list will one day be signed with
+// (docs/design/multi-device.md, step 2). Advertised now so the field is already
+// in the field when something reads it, exactly as the capability list was.
+//
+// It is **unauthenticated here** and must stay that way in every reader's mind
+// until step 3: the relay forwards it verbatim, so it can substitute one. What
+// makes an identity key trustworthy is a signed device list checked against it,
+// not its presence in a JOIN.
+export function createJoin(
+  nickname,
+  publicKeyB64,
+  pqPublicKeyB64 = null,
+  caps = null,
+  identityKeyB64 = null,
+  deviceList = null,
+) {
   const msg = { ...base(MSG.JOIN), nickname, publicKey: publicKeyB64 };
   if (pqPublicKeyB64) {
     msg.pqPublicKey = pqPublicKeyB64;
@@ -58,6 +73,15 @@ export function createJoin(nickname, publicKeyB64, pqPublicKeyB64 = null, caps =
   if (Array.isArray(caps) && caps.length > 0) {
     msg.caps = [...caps];
   }
+  if (identityKeyB64) {
+    msg.identityKey = identityKeyB64;
+  }
+  // Only needed when the nickname is already held by another of your devices.
+  // Sent always when there is one, because a client cannot know in advance
+  // whether its other device is already online.
+  if (deviceList) {
+    msg.deviceList = deviceList;
+  }
   return msg;
 }
 
@@ -249,8 +273,17 @@ export function createBanPeer(targetNickname, reason = '') {
   return { ...base(MSG.BAN_PEER), targetNickname, reason };
 }
 
-export function createPeerKicked(nickname, reason = '') {
-  return { ...base(MSG.PEER_KICKED), nickname, reason };
+// `sessionId` (optional) names *which* session was removed. `nickname` cannot:
+// it is not unique over time — /nick reassigns it — and a client that removed a
+// peer by name would drop the wrong session whenever two people had ever shared
+// one. Older clients ignore the field; it exists so a kick can be matched to the
+// `peer_left` that follows it and reported as a kick rather than a departure.
+export function createPeerKicked(nickname, reason = '', sessionId = null) {
+  const msg = { ...base(MSG.PEER_KICKED), nickname, reason };
+  if (sessionId) {
+    msg.sessionId = sessionId;
+  }
+  return msg;
 }
 
 export function createPeerMuted(nickname, durationMs) {

package/src/protocol/validators.js

@@ -2,6 +2,7 @@ import {
   PROTOCOL_VERSION,
   MAX_NICKNAME_LENGTH,
   MAX_PAYLOAD_SIZE,
+  IDENTITY_KEY_SIZE,
   PUBLIC_KEY_SIZE,
   ROOM_AUTH_PK_SIZE,
   ROOM_AUTH_SIG_SIZE,
@@ -131,6 +132,19 @@ export function validateJoin(msg) {
   if (msg.pqPublicKey !== undefined && !isValidBase64(msg.pqPublicKey, PQ_PUBLIC_KEY_SIZE)) {
     return { valid: false, error: 'Invalid post-quantum public key' };
   }
+  // Optional Ed25519 identity key (multi-device). Absent = a client from before
+  // it existed. Checked for shape only: the relay cannot tell whose key it is,
+  // and is not supposed to be able to.
+  if (msg.identityKey !== undefined && !isValidBase64(msg.identityKey, IDENTITY_KEY_SIZE)) {
+    return { valid: false, error: 'Invalid identity key' };
+  }
+  // Optional signed device list, used only to claim a nickname another of your
+  // own devices already holds. Shape here; the signature is checked where the
+  // claim is decided, because only there is it known what identity to check it
+  // against.
+  if (msg.deviceList !== undefined && (typeof msg.deviceList !== 'object' || !msg.deviceList)) {
+    return { valid: false, error: 'Invalid device list' };
+  }
   const capabilities = sanitizeCapabilities(msg.caps);
   if (capabilities === null) {
     return {
@@ -142,6 +156,8 @@ export function validateJoin(msg) {
     valid: true,
     nickname: nick,
     pqPublicKey: msg.pqPublicKey || null,
+    identityKey: msg.identityKey || null,
+    deviceList: msg.deviceList || null,
     capabilities,
   };
 }

package/src/server/SessionManager.js

@@ -5,7 +5,11 @@ const log = createLogger('session');
 
 export class SessionManager {
   #sessions; // Map<sessionId, { ws, nickname, publicKey, connectedAt, rooms: Set }>
-  #nicknames; // Set<nickname> for quick dupe check
+  // lowercased nickname -> the sessions holding it. A Set of names was enough
+  // while a name meant one connection; multi-device means several sessions can
+  // share one, and releasing the name when the *first* of them leaves would
+  // hand it to a stranger while its owner is still in the room.
+  #nicknames; // Map<lowerNickname, Set<sessionId>>
   #recentlyLeft; // Map<sessionId, { nickname, publicKey, leftAt }>
   #rooms; // Map<roomName, Set<sessionId>>
   #roomOwners; // Map<roomName, sessionId>
@@ -15,7 +19,7 @@ export class SessionManager {
 
   constructor() {
     this.#sessions = new Map();
-    this.#nicknames = new Set();
+    this.#nicknames = new Map();
     this.#recentlyLeft = new Map();
     this.#rooms = new Map();
     this.#roomOwners = new Map();
@@ -27,23 +31,68 @@ export class SessionManager {
   }
 
   isNicknameTaken(nickname) {
-    return this.#nicknames.has(nickname.toLowerCase());
+    return (this.#nicknames.get(nickname.toLowerCase())?.size ?? 0) > 0;
   }
 
-  addSession(ws, nickname, publicKey, room = 'general', pqPublicKey = null, capabilities = []) {
+  /**
+   * The identity key the sessions under this nickname are using, or null.
+   *
+   * Null when they disagree — which should not happen, since a second session
+   * is only admitted after matching, but a name whose holders cannot agree on
+   * an identity is not a name anything else should be admitted to.
+   */
+  identityForNickname(nickname) {
+    const holders = this.#nicknames.get(nickname.toLowerCase());
+    if (!holders || holders.size === 0) {
+      return null;
+    }
+    let identity = null;
+    for (const sessionId of holders) {
+      const key = this.#sessions.get(sessionId)?.identityKey ?? null;
+      if (!key || (identity && identity !== key)) {
+        return null;
+      }
+      identity = key;
+    }
+    return identity;
+  }
+
+  /** How many sessions currently answer to this nickname. */
+  sessionsForNickname(nickname) {
+    return this.#nicknames.get(nickname.toLowerCase())?.size ?? 0;
+  }
+
+  addSession(
+    ws,
+    nickname,
+    publicKey,
+    room = 'general',
+    pqPublicKey = null,
+    capabilities = [],
+    identityKey = null,
+  ) {
     const sessionId = randomUUID();
     const session = {
       ws,
       nickname,
       publicKey,
       pqPublicKey, // ML-KEM-768 key, relayed verbatim (server never uses it)
+      // Ed25519 identity key, relayed verbatim like the rest. The relay cannot
+      // check it belongs to this session and must not pretend to: a client
+      // trusts an identity key because a signed device list says so, never
+      // because a relay repeated it.
+      identityKey,
       capabilities, // advertised in JOIN, relayed verbatim — the relay never acts on these
       connectedAt: Date.now(),
       rooms: new Set(),
     };
 
     this.#sessions.set(sessionId, session);
-    this.#nicknames.add(nickname.toLowerCase());
+    const lower = nickname.toLowerCase();
+    if (!this.#nicknames.has(lower)) {
+      this.#nicknames.set(lower, new Set());
+    }
+    this.#nicknames.get(lower).add(sessionId);
     this.#joinRoom(sessionId, room);
 
     log.info(`${nickname} connected (${sessionId.slice(0, 8)}) in room ${room}`);
@@ -59,7 +108,14 @@ export class SessionManager {
     for (const room of [...session.rooms]) {
       this.#leaveRoom(sessionId, room);
     }
-    this.#nicknames.delete(session.nickname.toLowerCase());
+    const lower = session.nickname.toLowerCase();
+    const holders = this.#nicknames.get(lower);
+    if (holders) {
+      holders.delete(sessionId);
+      if (holders.size === 0) {
+        this.#nicknames.delete(lower);
+      }
+    }
     this.#sessions.delete(sessionId);
     this.#muteState.delete(sessionId);
 
@@ -105,6 +161,7 @@ export class SessionManager {
           nickname: session.nickname,
           publicKey: session.publicKey,
           ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+          ...(session.identityKey ? { identityKey: session.identityKey } : {}),
           ...(session.capabilities?.length ? { caps: [...session.capabilities] } : {}),
         });
       }

package/src/server/WebSocketServer.js

@@ -44,6 +44,7 @@ import {
   validateBanPeer,
 } from '../protocol/validators.js';
 import { verifyRoomChallenge } from '../crypto/RoomKey.js';
+import { DEVICE_LIMITS, verifyDeviceList } from '../crypto/DeviceIdentity.js';
 import { parseServerConfig, clientAddress, normalizeIp } from './config.js';
 
 const log = createLogger('ws-server');
@@ -281,6 +282,37 @@ export class SecureWSServer {
     }
   }
 
+  /**
+   * May this JOIN share a nickname that is already in use?
+   *
+   * Only if it is another device of whoever holds it. The proof is the signed
+   * device list in the JOIN: it must be signed by the identity the existing
+   * sessions are using, and it must name *this* JOIN's public key.
+   *
+   * No challenge is needed and none is invented. Replaying a list somebody else
+   * published gets you a seat in a room under a name whose messages you cannot
+   * read, because you do not hold the box secret the list names — and the peers,
+   * who do their own checking, learn nothing from the relay having allowed it.
+   * The relay is doing admission control on a nickname here, not attesting to
+   * anyone's identity; clients never take its word for that.
+   */
+  #isAnotherDeviceOf(validation, publicKey) {
+    const identityKey = this.#sessionManager.identityForNickname(validation.nickname);
+    if (!identityKey || !validation.identityKey || validation.identityKey !== identityKey) {
+      return false;
+    }
+    const list = verifyDeviceList(validation.deviceList);
+    if (!list || list.identityPk !== identityKey) {
+      return false;
+    }
+    if (
+      this.#sessionManager.sessionsForNickname(validation.nickname) >= DEVICE_LIMITS.MAX_DEVICES
+    ) {
+      return false;
+    }
+    return list.devices.some((device) => device.boxPk === publicKey);
+  }
+
   #handleJoin(ws, msg) {
     if (ws.hasJoined) {
       ws.send(JSON.stringify(createError(ERR.INVALID_MESSAGE, 'Already in the chat')));
@@ -293,7 +325,10 @@ export class SecureWSServer {
       return;
     }
 
-    if (this.#sessionManager.isNicknameTaken(validation.nickname)) {
+    if (
+      this.#sessionManager.isNicknameTaken(validation.nickname) &&
+      !this.#isAnotherDeviceOf(validation, msg.publicKey)
+    ) {
       ws.send(
         JSON.stringify(
           createError(ERR.NICKNAME_TAKEN, `Nickname "${validation.nickname}" is already in use`),
@@ -310,6 +345,7 @@ export class SecureWSServer {
       room,
       validation.pqPublicKey,
       validation.capabilities,
+      validation.identityKey,
     );
     ws.sessionId = sessionId;
     ws.hasJoined = true;
@@ -347,6 +383,7 @@ export class SecureWSServer {
         nickname: validation.nickname,
         publicKey: msg.publicKey,
         ...(validation.pqPublicKey ? { pqPublicKey: validation.pqPublicKey } : {}),
+        ...(validation.identityKey ? { identityKey: validation.identityKey } : {}),
         ...(validation.capabilities.length ? { caps: [...validation.capabilities] } : {}),
       }),
       sessionId,
@@ -665,6 +702,7 @@ export class SecureWSServer {
           nickname: session.nickname,
           publicKey: session.publicKey,
           ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+          ...(session.identityKey ? { identityKey: session.identityKey } : {}),
         },
         room,
       ),
@@ -776,6 +814,27 @@ export class SecureWSServer {
     this.#finishRoomSwitch(ws, session, result);
   }
 
+  // One session stopped being in one room. Every way out of a room ends here:
+  // leaving, switching, disconnecting, and — since this was the gap — being
+  // kicked or banned.
+  //
+  // Kick and ban used to announce only `peer_kicked`, which carries a nickname
+  // and no session. Clients had nothing to remove a member *by*, so the removed
+  // peer stayed in every remaining roster. Harmless-looking while the relay path
+  // seals one envelope per peer; not harmless at all once a room encrypts once
+  // to a shared chain, because "who is still in this room" is then the input to
+  // when that chain must be rotated away from someone.
+  #emitRoomDeparture(room, sessionId, nickname) {
+    if (!room || !sessionId) {
+      return;
+    }
+    this.#sessionManager.broadcastToRoom(
+      room,
+      createPeerLeft(sessionId, nickname || 'Unknown', room),
+      sessionId,
+    );
+  }
+
   // Shared tail of a successful room switch: notify every old room and send
   // the ROOM_CHANGED (with the private flag) to the mover.
   #finishRoomSwitch(ws, session, result) {
@@ -800,6 +859,7 @@ export class SecureWSServer {
           nickname: session.nickname,
           publicKey: session.publicKey,
           ...(session.pqPublicKey ? { pqPublicKey: session.pqPublicKey } : {}),
+          ...(session.identityKey ? { identityKey: session.identityKey } : {}),
         },
         result.newRoom,
       ),
@@ -902,11 +962,14 @@ export class SecureWSServer {
     if (result) {
       const targetSession = this.#sessionManager.getSession(targetSessionId);
 
-      // Notify old room
+      // Notify old room. The kick goes first so a client can mark the session
+      // before the peer_left lands and report it as a kick rather than a
+      // departure; both travel the same socket, so the order holds.
       this.#sessionManager.broadcastToRoom(
         room,
-        createPeerKicked(validation.targetNickname, validation.reason),
+        createPeerKicked(validation.targetNickname, validation.reason, targetSessionId),
       );
+      this.#emitRoomDeparture(room, targetSessionId, targetSession?.nickname);
 
       // Notify target with room change + kick reason
       const newPeers = this.#sessionManager.getRoomPeers('general', targetSessionId);
@@ -1018,8 +1081,9 @@ export class SecureWSServer {
     if (result) {
       this.#sessionManager.broadcastToRoom(
         room,
-        createPeerKicked(validation.targetNickname, validation.reason || 'banned'),
+        createPeerKicked(validation.targetNickname, validation.reason || 'banned', targetSessionId),
       );
+      this.#emitRoomDeparture(room, targetSessionId, targetSession?.nickname);
 
       const newPeers = this.#sessionManager.getRoomPeers('general', targetSessionId);
       targetSession.ws.send(JSON.stringify(createRoomChanged('general', newPeers)));

package/src/shared/constants.js

@@ -17,11 +17,15 @@ export const CAP = {
   // and fan-out land a release before anyone sends, so that by the time a sender
   // exists, every advertised room can already read it.
   SENDER_KEYS: 'sk1',
+  // I can read a signed device list handed to me over the pairwise channel.
+  // Client-only: distribution rides the sealed channel the relay already
+  // carries, so unlike sk1 there is nothing for the relay to agree to.
+  DEVICE_LIST: 'dl1',
 };
 
 // What this client advertises. SENDER_KEYS is honest here: the receive path
 // exists. Nothing sends group messages yet.
-export const OWN_CAPABILITIES = [CAP.SENDER_KEYS];
+export const OWN_CAPABILITIES = [CAP.SENDER_KEYS, CAP.DEVICE_LIST];
 
 // What the relay advertises, in join_ack. A client cannot promise this on the
 // relay's behalf — the fan-out is the relay's job — so a sender has to check the
@@ -71,6 +75,10 @@ export const MAX_BYTES_BURST = 4_194_304;
 // Crypto sizes (libsodium Curve25519 + XSalsa20-Poly1305)
 export const NONCE_SIZE = 24;
 export const PUBLIC_KEY_SIZE = 32;
+// Ed25519, and the same 32 bytes as above by coincidence of the curves rather
+// than by anything shared. Named separately so a future change to one does not
+// silently resize the other.
+export const IDENTITY_KEY_SIZE = 32;
 export const SECRET_KEY_SIZE = 32;
 export const MAC_SIZE = 16;
 export const SHARED_KEY_SIZE = 32;