wire-mesh-core 1.30.1 → 1.32.0

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { N as Frame } from "../protocol-sW8d6Og-.cjs";
+import { N as Frame } from "../protocol-gbXtNeOc.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { N as Frame } from "../protocol-sW8d6Og-.mjs";
+import { N as Frame } from "../protocol-gbXtNeOc.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/node-identity.cjs

@@ -31,14 +31,25 @@ async function verifyWithPublicKey(key, message, signature) {
 	return node_crypto.webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**
+* Imports a peer's ES256 identity-key for ECDH deriveBits usage. Only ever called with an already-published public key (this node's own peers' identity-keys), never private material, so there is no custody concern here the way there is for the local node's own private key.
+*/
+async function importEs256PublicKeyForEcdh(key) {
+	return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []);
+}
+/**
 * Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+*
+* `ecdhPrivateKey`, when given, must be a `{name: "ECDH", namedCurve: "P-256"}`-usage `deriveBits`-capable CryptoKey imported from the SAME underlying scalar as `privateKey` -- Web Crypto permanently binds a CryptoKey to the one algorithm it was imported for, so an ECDSA-usage key can never itself be used for `deriveBits`, even though ECDH and ECDSA share the identical P-256 curve and scalar. Room rekey's own ECIES construction reuses each member's existing identity-key rather than minting a separate encryption key (wire-mesh#141), so a caller wanting `deriveSharedSecret` imports the same scalar a second time under `{name: "ECDH"}` and passes both keys here -- deliberately the CALLER's own choice, not done automatically inside this function, so a caller that generated `privateKey` as `extractable: false` for signing-only isn't forced to also make it extractable (the only way to obtain a second, differently-algorithmed CryptoKey from the same scalar) just to satisfy a capability it never asked for.
 */
-async function createNodeIdentity(privateKey, publicKeyBytes, alg) {
+async function createNodeIdentity(privateKey, publicKeyBytes, alg, ecdhPrivateKey) {
 	const identityKey = {
 		alg,
 		"public-key": toBufferSource(publicKeyBytes)
 	};
-	return {
+	const base = {
 		deviceId: await deriveDeviceId(publicKeyBytes),
 		identityKey,
 		async sign(message) {
@@ -48,6 +59,19 @@ async function createNodeIdentity(privateKey, publicKeyBytes, alg) {
 		verify: verifyWithPublicKey,
 		deriveDeviceId
 	};
+	if (alg !== ES256 || ecdhPrivateKey === void 0) return base;
+	return {
+		...base,
+		async deriveSharedSecret(peerKey) {
+			if (peerKey.alg !== ES256) throw new Error(`ECDH is only defined for an ES256 peer identity-key, got alg ${String(peerKey.alg)}`);
+			const peerPublicKey = await importEs256PublicKeyForEcdh(peerKey);
+			const bits = await node_crypto.webcrypto.subtle.deriveBits({
+				name: "ECDH",
+				public: peerPublicKey
+			}, ecdhPrivateKey, 256);
+			return new Uint8Array(bits);
+		}
+	};
 }
 //#endregion
 exports.createNodeIdentity = createNodeIdentity;

package/dist/adapters/node-identity.d.cts

@@ -1,11 +1,13 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-sW8d6Og-.cjs";
-import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;
 export declare function verifyWithPublicKey(key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
 /**
  * Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+ *
+ * `ecdhPrivateKey`, when given, must be a `{name: "ECDH", namedCurve: "P-256"}`-usage `deriveBits`-capable CryptoKey imported from the SAME underlying scalar as `privateKey` -- Web Crypto permanently binds a CryptoKey to the one algorithm it was imported for, so an ECDSA-usage key can never itself be used for `deriveBits`, even though ECDH and ECDSA share the identical P-256 curve and scalar. Room rekey's own ECIES construction reuses each member's existing identity-key rather than minting a separate encryption key (wire-mesh#141), so a caller wanting `deriveSharedSecret` imports the same scalar a second time under `{name: "ECDH"}` and passes both keys here -- deliberately the CALLER's own choice, not done automatically inside this function, so a caller that generated `privateKey` as `extractable: false` for signing-only isn't forced to also make it extractable (the only way to obtain a second, differently-algorithmed CryptoKey from the same scalar) just to satisfy a capability it never asked for.
  */
-export declare function createNodeIdentity(privateKey: webcrypto.CryptoKey, publicKeyBytes: Uint8Array, alg: number): Promise<IdentityPort>;
+export declare function createNodeIdentity(privateKey: webcrypto.CryptoKey, publicKeyBytes: Uint8Array, alg: number, ecdhPrivateKey?: webcrypto.CryptoKey): Promise<IdentityPort>;
 //#endregion

package/dist/adapters/node-identity.d.mts

@@ -1,11 +1,13 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-sW8d6Og-.mjs";
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;
 export declare function verifyWithPublicKey(key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
 /**
  * Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+ *
+ * `ecdhPrivateKey`, when given, must be a `{name: "ECDH", namedCurve: "P-256"}`-usage `deriveBits`-capable CryptoKey imported from the SAME underlying scalar as `privateKey` -- Web Crypto permanently binds a CryptoKey to the one algorithm it was imported for, so an ECDSA-usage key can never itself be used for `deriveBits`, even though ECDH and ECDSA share the identical P-256 curve and scalar. Room rekey's own ECIES construction reuses each member's existing identity-key rather than minting a separate encryption key (wire-mesh#141), so a caller wanting `deriveSharedSecret` imports the same scalar a second time under `{name: "ECDH"}` and passes both keys here -- deliberately the CALLER's own choice, not done automatically inside this function, so a caller that generated `privateKey` as `extractable: false` for signing-only isn't forced to also make it extractable (the only way to obtain a second, differently-algorithmed CryptoKey from the same scalar) just to satisfy a capability it never asked for.
  */
-export declare function createNodeIdentity(privateKey: webcrypto.CryptoKey, publicKeyBytes: Uint8Array, alg: number): Promise<IdentityPort>;
+export declare function createNodeIdentity(privateKey: webcrypto.CryptoKey, publicKeyBytes: Uint8Array, alg: number, ecdhPrivateKey?: webcrypto.CryptoKey): Promise<IdentityPort>;
 //#endregion

package/dist/adapters/node-identity.mjs

@@ -30,14 +30,25 @@ async function verifyWithPublicKey(key, message, signature) {
 	return webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**
+* Imports a peer's ES256 identity-key for ECDH deriveBits usage. Only ever called with an already-published public key (this node's own peers' identity-keys), never private material, so there is no custody concern here the way there is for the local node's own private key.
+*/
+async function importEs256PublicKeyForEcdh(key) {
+	return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+		name: "ECDH",
+		namedCurve: "P-256"
+	}, false, []);
+}
+/**
 * Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+*
+* `ecdhPrivateKey`, when given, must be a `{name: "ECDH", namedCurve: "P-256"}`-usage `deriveBits`-capable CryptoKey imported from the SAME underlying scalar as `privateKey` -- Web Crypto permanently binds a CryptoKey to the one algorithm it was imported for, so an ECDSA-usage key can never itself be used for `deriveBits`, even though ECDH and ECDSA share the identical P-256 curve and scalar. Room rekey's own ECIES construction reuses each member's existing identity-key rather than minting a separate encryption key (wire-mesh#141), so a caller wanting `deriveSharedSecret` imports the same scalar a second time under `{name: "ECDH"}` and passes both keys here -- deliberately the CALLER's own choice, not done automatically inside this function, so a caller that generated `privateKey` as `extractable: false` for signing-only isn't forced to also make it extractable (the only way to obtain a second, differently-algorithmed CryptoKey from the same scalar) just to satisfy a capability it never asked for.
 */
-async function createNodeIdentity(privateKey, publicKeyBytes, alg) {
+async function createNodeIdentity(privateKey, publicKeyBytes, alg, ecdhPrivateKey) {
 	const identityKey = {
 		alg,
 		"public-key": toBufferSource(publicKeyBytes)
 	};
-	return {
+	const base = {
 		deviceId: await deriveDeviceId(publicKeyBytes),
 		identityKey,
 		async sign(message) {
@@ -47,6 +58,19 @@ async function createNodeIdentity(privateKey, publicKeyBytes, alg) {
 		verify: verifyWithPublicKey,
 		deriveDeviceId
 	};
+	if (alg !== ES256 || ecdhPrivateKey === void 0) return base;
+	return {
+		...base,
+		async deriveSharedSecret(peerKey) {
+			if (peerKey.alg !== ES256) throw new Error(`ECDH is only defined for an ES256 peer identity-key, got alg ${String(peerKey.alg)}`);
+			const peerPublicKey = await importEs256PublicKeyForEcdh(peerKey);
+			const bits = await webcrypto.subtle.deriveBits({
+				name: "ECDH",
+				public: peerPublicKey
+			}, ecdhPrivateKey, 256);
+			return new Uint8Array(bits);
+		}
+	};
 }
 //#endregion
 export { createNodeIdentity, deriveDeviceId, verifyWithPublicKey };

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DxZ4JWZc.cjs";
+import { r as Transport } from "../transport-DAsFqDDS.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B5E896PN.mjs";
+import { r as Transport } from "../transport-Dy4h2eNY.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DxZ4JWZc.cjs";
+import { r as Transport } from "../transport-DAsFqDDS.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B5E896PN.mjs";
+import { r as Transport } from "../transport-Dy4h2eNY.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/bulk.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-sW8d6Og-.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as Connection } from "../transport-DxZ4JWZc.cjs";
+import { t as Connection } from "../transport-DAsFqDDS.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-sW8d6Og-.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as Connection } from "../transport-B5E896PN.mjs";
+import { t as Connection } from "../transport-Dy4h2eNY.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-sW8d6Og-.cjs";
-import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-DfVfE00W.cjs";
+import { a as RevocationCheck } from "../tokens-CNQirfHi.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-sW8d6Og-.mjs";
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-CpLDI5Fo.mjs";
+import { a as RevocationCheck } from "../tokens-C_LvOuYO.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-sW8d6Og-.cjs";
-import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-sW8d6Og-.mjs";
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-sW8d6Og-.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-gbXtNeOc.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-sW8d6Og-.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-gbXtNeOc.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-sW8d6Og-.cjs";
+import { D as DeviceId } from "../protocol-gbXtNeOc.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-sW8d6Og-.mjs";
+import { D as DeviceId } from "../protocol-gbXtNeOc.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-sW8d6Og-.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-gbXtNeOc.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-sW8d6Og-.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-gbXtNeOc.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/group-key.cjs

@@ -0,0 +1,93 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/group-key.ts
+const AES_KEY_BYTE_LENGTH = 32;
+const AES_KEY_BIT_LENGTH = 256;
+const GCM_IV_BYTE_LENGTH = 12;
+const UINT32_BYTE_LENGTH = 4;
+const UINT64_BYTE_LENGTH = 8;
+const HKDF_INFO_PREFIX = new TextEncoder().encode("wire-mesh/room-rekey/v1\0");
+/** Generates a fresh, random 256-bit room content-encryption key (the thing room.rekey wraps and distributes, and that encryptNoticeContent/decryptNoticeContent use directly). */
+function generateContentKey() {
+	return crypto.getRandomValues(new Uint8Array(AES_KEY_BYTE_LENGTH));
+}
+/**
+* Binds HKDF's own `info` parameter to exactly the (room, key-epoch) pair a wrapping key is for, so a wrapping key derived for one room or one epoch can never successfully unwrap ciphertext produced under another -- domain separation from the derivation itself, not merely a convention callers must remember to check. Length-prefixing the room path (rather than a bare separator byte) keeps the encoding unambiguous regardless of what characters a room path itself may contain.
+*/
+function hkdfInfo(context) {
+	const roomBytes = new TextEncoder().encode(context.room);
+	const roomLength = new Uint8Array(UINT32_BYTE_LENGTH);
+	new DataView(roomLength.buffer).setUint32(0, roomBytes.length, false);
+	const keyEpoch = new Uint8Array(UINT64_BYTE_LENGTH);
+	new DataView(keyEpoch.buffer).setBigUint64(0, BigInt(context.keyEpoch), false);
+	const info = new Uint8Array(HKDF_INFO_PREFIX.length + roomLength.length + roomBytes.length + keyEpoch.length);
+	let offset = 0;
+	info.set(HKDF_INFO_PREFIX, offset);
+	offset += HKDF_INFO_PREFIX.length;
+	info.set(roomLength, offset);
+	offset += roomLength.length;
+	info.set(roomBytes, offset);
+	offset += roomBytes.length;
+	info.set(keyEpoch, offset);
+	return info;
+}
+/**
+* Derives an AES-256-GCM wrapping key from a raw ECDH shared secret (IdentityPort.deriveSharedSecret's own output) via HKDF-SHA256, with `info` binding the result to exactly one (room, key-epoch) pair -- see hkdfInfo. No explicit salt: static-static ECDH already produces a high-entropy, uniformly-distributed shared secret, so an empty salt is the standard, RFC 5869-sanctioned choice here rather than a corner cut (a salt matters most when the input key material's own entropy is questionable, which a P-256 ECDH output is not).
+*/
+async function deriveWrappingKey(sharedSecret, context) {
+	const ikm = await crypto.subtle.importKey("raw", Uint8Array.from(sharedSecret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: Uint8Array.from(/* @__PURE__ */ new Uint8Array(0)),
+		info: Uint8Array.from(hkdfInfo(context))
+	}, ikm, {
+		name: "AES-GCM",
+		length: AES_KEY_BIT_LENGTH
+	}, false, ["encrypt", "decrypt"]);
+}
+async function aesGcmEncrypt(key, plaintext) {
+	const iv = crypto.getRandomValues(new Uint8Array(GCM_IV_BYTE_LENGTH));
+	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, key, Uint8Array.from(plaintext)));
+	const out = new Uint8Array(iv.length + ciphertext.length);
+	out.set(iv, 0);
+	out.set(ciphertext, iv.length);
+	return out;
+}
+async function aesGcmDecrypt(key, ivAndCiphertext) {
+	if (ivAndCiphertext.length < GCM_IV_BYTE_LENGTH) throw new Error("ciphertext shorter than the AES-GCM IV it must carry");
+	const iv = ivAndCiphertext.slice(0, GCM_IV_BYTE_LENGTH);
+	const ciphertext = ivAndCiphertext.slice(GCM_IV_BYTE_LENGTH);
+	return new Uint8Array(await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv
+	}, key, ciphertext));
+}
+/** Wraps a room content-encryption key for delivery in room.rekey's own `wrapped-key` field. */
+async function wrapContentKey(wrappingKey, contentKey) {
+	return aesGcmEncrypt(wrappingKey, contentKey);
+}
+/** Unwraps a room.rekey `wrapped-key` entry back into the room content-encryption key it carries. Rejects (never returns a garbage key) if the wrapping key or ciphertext don't match -- AES-GCM's own authentication tag catches both a wrong key and any tampering. */
+async function unwrapContentKey(wrappingKey, wrapped) {
+	return aesGcmDecrypt(wrappingKey, wrapped);
+}
+async function importContentKey(contentKey) {
+	return crypto.subtle.importKey("raw", Uint8Array.from(contentKey), "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+/** Encrypts a room-notice's own `content` under the room's current content-encryption key -- encrypt-then-sign, layered underneath room-notice's existing cose-sign1 envelope (see room.cddl's key-epoch obligation), never a replacement for it. */
+async function encryptNoticeContent(contentKey, plaintext) {
+	return aesGcmEncrypt(await importContentKey(contentKey), plaintext);
+}
+/** Decrypts a room-notice's own `content`, given the content-encryption key for the epoch its key-epoch field names. Rejects on a wrong key or tampered ciphertext, same as unwrapContentKey. */
+async function decryptNoticeContent(contentKey, ciphertext) {
+	return aesGcmDecrypt(await importContentKey(contentKey), ciphertext);
+}
+//#endregion
+exports.decryptNoticeContent = decryptNoticeContent;
+exports.deriveWrappingKey = deriveWrappingKey;
+exports.encryptNoticeContent = encryptNoticeContent;
+exports.generateContentKey = generateContentKey;
+exports.unwrapContentKey = unwrapContentKey;
+exports.wrapContentKey = wrapContentKey;

package/dist/domain/group-key.d.cts

@@ -0,0 +1,24 @@
+//#region src/domain/group-key.d.ts
+/**
+ * The symmetric half of room.rekey's own ECIES key-wrapping construction (wire-mesh#141): HKDF-SHA256 turning a raw ECDH shared secret into a per-(room, key-epoch) AES-256-GCM wrapping key, and AES-256-GCM itself for wrapping a room's content-encryption key and for encrypting a room-notice's own content under it. The asymmetric half (producing the shared secret) lives behind IdentityPort.deriveSharedSecret instead -- these functions operate only on plain bytes already in hand, with no platform-specific key-custody concern, so they need no port of their own (see IdentityPort.deriveSharedSecret's own doc comment).
+ *
+ * A fresh random IV is generated for every AES-256-GCM operation here and prepended to the output -- never a fixed or derived IV -- since a wrapping key derived once per (room, key-epoch) may legitimately wrap more than once (e.g. a resent room.rekey), and reusing an AES-GCM IV under the same key is catastrophic (it discloses the authentication key and lets an attacker forge subsequent messages).
+ */
+/** Generates a fresh, random 256-bit room content-encryption key (the thing room.rekey wraps and distributes, and that encryptNoticeContent/decryptNoticeContent use directly). */
+export declare function generateContentKey(): Uint8Array<ArrayBuffer>;
+/**
+ * Derives an AES-256-GCM wrapping key from a raw ECDH shared secret (IdentityPort.deriveSharedSecret's own output) via HKDF-SHA256, with `info` binding the result to exactly one (room, key-epoch) pair -- see hkdfInfo. No explicit salt: static-static ECDH already produces a high-entropy, uniformly-distributed shared secret, so an empty salt is the standard, RFC 5869-sanctioned choice here rather than a corner cut (a salt matters most when the input key material's own entropy is questionable, which a P-256 ECDH output is not).
+ */
+export declare function deriveWrappingKey(sharedSecret: Uint8Array, context: Readonly<{
+  room: string;
+  keyEpoch: number;
+}>): Promise<CryptoKey>;
+/** Wraps a room content-encryption key for delivery in room.rekey's own `wrapped-key` field. */
+export declare function wrapContentKey(wrappingKey: CryptoKey, contentKey: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** Unwraps a room.rekey `wrapped-key` entry back into the room content-encryption key it carries. Rejects (never returns a garbage key) if the wrapping key or ciphertext don't match -- AES-GCM's own authentication tag catches both a wrong key and any tampering. */
+export declare function unwrapContentKey(wrappingKey: CryptoKey, wrapped: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** Encrypts a room-notice's own `content` under the room's current content-encryption key -- encrypt-then-sign, layered underneath room-notice's existing cose-sign1 envelope (see room.cddl's key-epoch obligation), never a replacement for it. */
+export declare function encryptNoticeContent(contentKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** Decrypts a room-notice's own `content`, given the content-encryption key for the epoch its key-epoch field names. Rejects on a wrong key or tampered ciphertext, same as unwrapContentKey. */
+export declare function decryptNoticeContent(contentKey: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+//#endregion

package/dist/domain/group-key.d.mts

@@ -0,0 +1,24 @@
+//#region src/domain/group-key.d.ts
+/**
+ * The symmetric half of room.rekey's own ECIES key-wrapping construction (wire-mesh#141): HKDF-SHA256 turning a raw ECDH shared secret into a per-(room, key-epoch) AES-256-GCM wrapping key, and AES-256-GCM itself for wrapping a room's content-encryption key and for encrypting a room-notice's own content under it. The asymmetric half (producing the shared secret) lives behind IdentityPort.deriveSharedSecret instead -- these functions operate only on plain bytes already in hand, with no platform-specific key-custody concern, so they need no port of their own (see IdentityPort.deriveSharedSecret's own doc comment).
+ *
+ * A fresh random IV is generated for every AES-256-GCM operation here and prepended to the output -- never a fixed or derived IV -- since a wrapping key derived once per (room, key-epoch) may legitimately wrap more than once (e.g. a resent room.rekey), and reusing an AES-GCM IV under the same key is catastrophic (it discloses the authentication key and lets an attacker forge subsequent messages).
+ */
+/** Generates a fresh, random 256-bit room content-encryption key (the thing room.rekey wraps and distributes, and that encryptNoticeContent/decryptNoticeContent use directly). */
+export declare function generateContentKey(): Uint8Array<ArrayBuffer>;
+/**
+ * Derives an AES-256-GCM wrapping key from a raw ECDH shared secret (IdentityPort.deriveSharedSecret's own output) via HKDF-SHA256, with `info` binding the result to exactly one (room, key-epoch) pair -- see hkdfInfo. No explicit salt: static-static ECDH already produces a high-entropy, uniformly-distributed shared secret, so an empty salt is the standard, RFC 5869-sanctioned choice here rather than a corner cut (a salt matters most when the input key material's own entropy is questionable, which a P-256 ECDH output is not).
+ */
+export declare function deriveWrappingKey(sharedSecret: Uint8Array, context: Readonly<{
+  room: string;
+  keyEpoch: number;
+}>): Promise<CryptoKey>;
+/** Wraps a room content-encryption key for delivery in room.rekey's own `wrapped-key` field. */
+export declare function wrapContentKey(wrappingKey: CryptoKey, contentKey: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** Unwraps a room.rekey `wrapped-key` entry back into the room content-encryption key it carries. Rejects (never returns a garbage key) if the wrapping key or ciphertext don't match -- AES-GCM's own authentication tag catches both a wrong key and any tampering. */
+export declare function unwrapContentKey(wrappingKey: CryptoKey, wrapped: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** Encrypts a room-notice's own `content` under the room's current content-encryption key -- encrypt-then-sign, layered underneath room-notice's existing cose-sign1 envelope (see room.cddl's key-epoch obligation), never a replacement for it. */
+export declare function encryptNoticeContent(contentKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** Decrypts a room-notice's own `content`, given the content-encryption key for the epoch its key-epoch field names. Rejects on a wrong key or tampered ciphertext, same as unwrapContentKey. */
+export declare function decryptNoticeContent(contentKey: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+//#endregion

package/dist/domain/group-key.mjs

@@ -0,0 +1,87 @@
+//#region src/domain/group-key.ts
+const AES_KEY_BYTE_LENGTH = 32;
+const AES_KEY_BIT_LENGTH = 256;
+const GCM_IV_BYTE_LENGTH = 12;
+const UINT32_BYTE_LENGTH = 4;
+const UINT64_BYTE_LENGTH = 8;
+const HKDF_INFO_PREFIX = new TextEncoder().encode("wire-mesh/room-rekey/v1\0");
+/** Generates a fresh, random 256-bit room content-encryption key (the thing room.rekey wraps and distributes, and that encryptNoticeContent/decryptNoticeContent use directly). */
+function generateContentKey() {
+	return crypto.getRandomValues(new Uint8Array(AES_KEY_BYTE_LENGTH));
+}
+/**
+* Binds HKDF's own `info` parameter to exactly the (room, key-epoch) pair a wrapping key is for, so a wrapping key derived for one room or one epoch can never successfully unwrap ciphertext produced under another -- domain separation from the derivation itself, not merely a convention callers must remember to check. Length-prefixing the room path (rather than a bare separator byte) keeps the encoding unambiguous regardless of what characters a room path itself may contain.
+*/
+function hkdfInfo(context) {
+	const roomBytes = new TextEncoder().encode(context.room);
+	const roomLength = new Uint8Array(UINT32_BYTE_LENGTH);
+	new DataView(roomLength.buffer).setUint32(0, roomBytes.length, false);
+	const keyEpoch = new Uint8Array(UINT64_BYTE_LENGTH);
+	new DataView(keyEpoch.buffer).setBigUint64(0, BigInt(context.keyEpoch), false);
+	const info = new Uint8Array(HKDF_INFO_PREFIX.length + roomLength.length + roomBytes.length + keyEpoch.length);
+	let offset = 0;
+	info.set(HKDF_INFO_PREFIX, offset);
+	offset += HKDF_INFO_PREFIX.length;
+	info.set(roomLength, offset);
+	offset += roomLength.length;
+	info.set(roomBytes, offset);
+	offset += roomBytes.length;
+	info.set(keyEpoch, offset);
+	return info;
+}
+/**
+* Derives an AES-256-GCM wrapping key from a raw ECDH shared secret (IdentityPort.deriveSharedSecret's own output) via HKDF-SHA256, with `info` binding the result to exactly one (room, key-epoch) pair -- see hkdfInfo. No explicit salt: static-static ECDH already produces a high-entropy, uniformly-distributed shared secret, so an empty salt is the standard, RFC 5869-sanctioned choice here rather than a corner cut (a salt matters most when the input key material's own entropy is questionable, which a P-256 ECDH output is not).
+*/
+async function deriveWrappingKey(sharedSecret, context) {
+	const ikm = await crypto.subtle.importKey("raw", Uint8Array.from(sharedSecret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: Uint8Array.from(/* @__PURE__ */ new Uint8Array(0)),
+		info: Uint8Array.from(hkdfInfo(context))
+	}, ikm, {
+		name: "AES-GCM",
+		length: AES_KEY_BIT_LENGTH
+	}, false, ["encrypt", "decrypt"]);
+}
+async function aesGcmEncrypt(key, plaintext) {
+	const iv = crypto.getRandomValues(new Uint8Array(GCM_IV_BYTE_LENGTH));
+	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, key, Uint8Array.from(plaintext)));
+	const out = new Uint8Array(iv.length + ciphertext.length);
+	out.set(iv, 0);
+	out.set(ciphertext, iv.length);
+	return out;
+}
+async function aesGcmDecrypt(key, ivAndCiphertext) {
+	if (ivAndCiphertext.length < GCM_IV_BYTE_LENGTH) throw new Error("ciphertext shorter than the AES-GCM IV it must carry");
+	const iv = ivAndCiphertext.slice(0, GCM_IV_BYTE_LENGTH);
+	const ciphertext = ivAndCiphertext.slice(GCM_IV_BYTE_LENGTH);
+	return new Uint8Array(await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv
+	}, key, ciphertext));
+}
+/** Wraps a room content-encryption key for delivery in room.rekey's own `wrapped-key` field. */
+async function wrapContentKey(wrappingKey, contentKey) {
+	return aesGcmEncrypt(wrappingKey, contentKey);
+}
+/** Unwraps a room.rekey `wrapped-key` entry back into the room content-encryption key it carries. Rejects (never returns a garbage key) if the wrapping key or ciphertext don't match -- AES-GCM's own authentication tag catches both a wrong key and any tampering. */
+async function unwrapContentKey(wrappingKey, wrapped) {
+	return aesGcmDecrypt(wrappingKey, wrapped);
+}
+async function importContentKey(contentKey) {
+	return crypto.subtle.importKey("raw", Uint8Array.from(contentKey), "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+/** Encrypts a room-notice's own `content` under the room's current content-encryption key -- encrypt-then-sign, layered underneath room-notice's existing cose-sign1 envelope (see room.cddl's key-epoch obligation), never a replacement for it. */
+async function encryptNoticeContent(contentKey, plaintext) {
+	return aesGcmEncrypt(await importContentKey(contentKey), plaintext);
+}
+/** Decrypts a room-notice's own `content`, given the content-encryption key for the epoch its key-epoch field names. Rejects on a wrong key or tampered ciphertext, same as unwrapContentKey. */
+async function decryptNoticeContent(contentKey, ciphertext) {
+	return aesGcmDecrypt(await importContentKey(contentKey), ciphertext);
+}
+//#endregion
+export { decryptNoticeContent, deriveWrappingKey, encryptNoticeContent, generateContentKey, unwrapContentKey, wrapContentKey };

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-sW8d6Og-.cjs";
+import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-gbXtNeOc.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-sW8d6Og-.mjs";
+import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-gbXtNeOc.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
-import { D as DeviceId, N as Frame, Q as PeerAdvert, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken } from "../protocol-sW8d6Og-.cjs";
-import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
+import { D as DeviceId, N as Frame, Q as PeerAdvert, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { r as Transport, t as Connection } from "../transport-DxZ4JWZc.cjs";
+import { r as Transport, t as Connection } from "../transport-DAsFqDDS.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as DeviceId, N as Frame, Q as PeerAdvert, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken } from "../protocol-sW8d6Og-.mjs";
-import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
+import { D as DeviceId, N as Frame, Q as PeerAdvert, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-B5E896PN.mjs";
+import { r as Transport, t as Connection } from "../transport-Dy4h2eNY.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-sW8d6Og-.cjs";
-import { t as Connection } from "../transport-DxZ4JWZc.cjs";
+import { N as Frame } from "../protocol-gbXtNeOc.cjs";
+import { t as Connection } from "../transport-DAsFqDDS.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-sW8d6Og-.mjs";
-import { t as Connection } from "../transport-B5E896PN.mjs";
+import { N as Frame } from "../protocol-gbXtNeOc.mjs";
+import { t as Connection } from "../transport-Dy4h2eNY.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-sW8d6Og-.cjs";
-import { t as Connection } from "../transport-DxZ4JWZc.cjs";
+import { N as Frame } from "../protocol-gbXtNeOc.cjs";
+import { t as Connection } from "../transport-DAsFqDDS.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */