wire-mesh-core 1.32.0 → 1.34.0

package/dist/domain/capability-grant.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-grant.d.cts

@@ -2,7 +2,7 @@ import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as Capabilit
 import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-CNQirfHi.cjs";
+import { a as RevocationCheck } from "../tokens-C9Kwy0Gk.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -2,7 +2,7 @@ import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as Capabilit
 import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-C_LvOuYO.mjs";
+import { a as RevocationCheck } from "../tokens-k172l0Iy.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
 import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { i as verifyCapabilityToken } from "../tokens-VicRWTj1.mjs";
+import { i as verifyCapabilityToken } from "../tokens-CdQwzCyJ.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/capability-request.mjs

@@ -1,5 +1,5 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as mintCapabilityToken } from "../tokens-VicRWTj1.mjs";
+import { n as mintCapabilityToken } from "../tokens-CdQwzCyJ.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/group-key.cjs

@@ -84,10 +84,28 @@ async function encryptNoticeContent(contentKey, plaintext) {
 async function decryptNoticeContent(contentKey, ciphertext) {
 	return aesGcmDecrypt(await importContentKey(contentKey), ciphertext);
 }
+/** The literal content-type suffix marking a room-notice's content as AES-256-GCM-encrypted under a room.rekey epoch's content key (room.cddl's own key-epoch obligation comment) -- the same suffix convention MIME structured syntaxes like `application/jose+json` already use, so a reader without the key still learns the notice's true underlying kind. */
+const ENCRYPTED_CONTENT_TYPE_SUFFIX = "+aes256gcm";
+/** The notice's own TRUE content-type, with the encryption suffix appended -- never a separate generic sentinel, so the true type stays visible without decrypting anything. Idempotent: an already-suffixed type is returned unchanged. */
+function encryptedContentType(plaintextContentType_) {
+	return isEncryptedContentType(plaintextContentType_) ? plaintextContentType_ : `${plaintextContentType_}${ENCRYPTED_CONTENT_TYPE_SUFFIX}`;
+}
+/** Strips the encryption suffix back off, recovering the plaintext content-type the sender originally had. A content-type carrying no suffix is returned unchanged. */
+function plaintextContentType(encryptedContentType_) {
+	return isEncryptedContentType(encryptedContentType_) ? encryptedContentType_.slice(0, encryptedContentType_.length - 10) : encryptedContentType_;
+}
+/** Whether a content-type names encrypted content (and therefore that the notice carrying it MUST also name its key-epoch -- room.cddl obligation 7). */
+function isEncryptedContentType(contentType) {
+	return contentType.endsWith(ENCRYPTED_CONTENT_TYPE_SUFFIX);
+}
 //#endregion
+exports.ENCRYPTED_CONTENT_TYPE_SUFFIX = ENCRYPTED_CONTENT_TYPE_SUFFIX;
 exports.decryptNoticeContent = decryptNoticeContent;
 exports.deriveWrappingKey = deriveWrappingKey;
 exports.encryptNoticeContent = encryptNoticeContent;
+exports.encryptedContentType = encryptedContentType;
 exports.generateContentKey = generateContentKey;
+exports.isEncryptedContentType = isEncryptedContentType;
+exports.plaintextContentType = plaintextContentType;
 exports.unwrapContentKey = unwrapContentKey;
 exports.wrapContentKey = wrapContentKey;

package/dist/domain/group-key.d.cts

@@ -21,4 +21,12 @@ export declare function unwrapContentKey(wrappingKey: CryptoKey, wrapped: Uint8A
 export declare function encryptNoticeContent(contentKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
 /** Decrypts a room-notice's own `content`, given the content-encryption key for the epoch its key-epoch field names. Rejects on a wrong key or tampered ciphertext, same as unwrapContentKey. */
 export declare function decryptNoticeContent(contentKey: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** The literal content-type suffix marking a room-notice's content as AES-256-GCM-encrypted under a room.rekey epoch's content key (room.cddl's own key-epoch obligation comment) -- the same suffix convention MIME structured syntaxes like `application/jose+json` already use, so a reader without the key still learns the notice's true underlying kind. */
+export declare const ENCRYPTED_CONTENT_TYPE_SUFFIX = "+aes256gcm";
+/** The notice's own TRUE content-type, with the encryption suffix appended -- never a separate generic sentinel, so the true type stays visible without decrypting anything. Idempotent: an already-suffixed type is returned unchanged. */
+export declare function encryptedContentType(plaintextContentType_: string): string;
+/** Strips the encryption suffix back off, recovering the plaintext content-type the sender originally had. A content-type carrying no suffix is returned unchanged. */
+export declare function plaintextContentType(encryptedContentType_: string): string;
+/** Whether a content-type names encrypted content (and therefore that the notice carrying it MUST also name its key-epoch -- room.cddl obligation 7). */
+export declare function isEncryptedContentType(contentType: string): boolean;
 //#endregion

package/dist/domain/group-key.d.mts

@@ -21,4 +21,12 @@ export declare function unwrapContentKey(wrappingKey: CryptoKey, wrapped: Uint8A
 export declare function encryptNoticeContent(contentKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
 /** Decrypts a room-notice's own `content`, given the content-encryption key for the epoch its key-epoch field names. Rejects on a wrong key or tampered ciphertext, same as unwrapContentKey. */
 export declare function decryptNoticeContent(contentKey: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
+/** The literal content-type suffix marking a room-notice's content as AES-256-GCM-encrypted under a room.rekey epoch's content key (room.cddl's own key-epoch obligation comment) -- the same suffix convention MIME structured syntaxes like `application/jose+json` already use, so a reader without the key still learns the notice's true underlying kind. */
+export declare const ENCRYPTED_CONTENT_TYPE_SUFFIX = "+aes256gcm";
+/** The notice's own TRUE content-type, with the encryption suffix appended -- never a separate generic sentinel, so the true type stays visible without decrypting anything. Idempotent: an already-suffixed type is returned unchanged. */
+export declare function encryptedContentType(plaintextContentType_: string): string;
+/** Strips the encryption suffix back off, recovering the plaintext content-type the sender originally had. A content-type carrying no suffix is returned unchanged. */
+export declare function plaintextContentType(encryptedContentType_: string): string;
+/** Whether a content-type names encrypted content (and therefore that the notice carrying it MUST also name its key-epoch -- room.cddl obligation 7). */
+export declare function isEncryptedContentType(contentType: string): boolean;
 //#endregion

package/dist/domain/group-key.mjs

@@ -83,5 +83,19 @@ async function encryptNoticeContent(contentKey, plaintext) {
 async function decryptNoticeContent(contentKey, ciphertext) {
 	return aesGcmDecrypt(await importContentKey(contentKey), ciphertext);
 }
+/** The literal content-type suffix marking a room-notice's content as AES-256-GCM-encrypted under a room.rekey epoch's content key (room.cddl's own key-epoch obligation comment) -- the same suffix convention MIME structured syntaxes like `application/jose+json` already use, so a reader without the key still learns the notice's true underlying kind. */
+const ENCRYPTED_CONTENT_TYPE_SUFFIX = "+aes256gcm";
+/** The notice's own TRUE content-type, with the encryption suffix appended -- never a separate generic sentinel, so the true type stays visible without decrypting anything. Idempotent: an already-suffixed type is returned unchanged. */
+function encryptedContentType(plaintextContentType_) {
+	return isEncryptedContentType(plaintextContentType_) ? plaintextContentType_ : `${plaintextContentType_}${ENCRYPTED_CONTENT_TYPE_SUFFIX}`;
+}
+/** Strips the encryption suffix back off, recovering the plaintext content-type the sender originally had. A content-type carrying no suffix is returned unchanged. */
+function plaintextContentType(encryptedContentType_) {
+	return isEncryptedContentType(encryptedContentType_) ? encryptedContentType_.slice(0, encryptedContentType_.length - 10) : encryptedContentType_;
+}
+/** Whether a content-type names encrypted content (and therefore that the notice carrying it MUST also name its key-epoch -- room.cddl obligation 7). */
+function isEncryptedContentType(contentType) {
+	return contentType.endsWith(ENCRYPTED_CONTENT_TYPE_SUFFIX);
+}
 //#endregion
-export { decryptNoticeContent, deriveWrappingKey, encryptNoticeContent, generateContentKey, unwrapContentKey, wrapContentKey };
+export { ENCRYPTED_CONTENT_TYPE_SUFFIX, decryptNoticeContent, deriveWrappingKey, encryptNoticeContent, encryptedContentType, generateContentKey, isEncryptedContentType, plaintextContentType, unwrapContentKey, wrapContentKey };

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
 import { _t as RevocationEntry } from "../protocol-gbXtNeOc.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CNQirfHi.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-C9Kwy0Gk.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
 import { _t as RevocationEntry } from "../protocol-gbXtNeOc.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-C_LvOuYO.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-k172l0Iy.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
 import { bytesToHex } from "./device-id.mjs";
-import { a as verifyRevocationEntry } from "../tokens-VicRWTj1.mjs";
+import { a as verifyRevocationEntry } from "../tokens-CdQwzCyJ.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-rekey.cjs

@@ -0,0 +1,112 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+const require_domain_group_key = require("./group-key.cjs");
+const require_domain_room_token_verification = require("./room-token-verification.cjs");
+//#region src/domain/room-rekey.ts
+/**
+* room.rekey (wire-mesh#141, spec/room.cddl): distributes and rotates a room's symmetric content-encryption key. Two responsibilities, split the same way capability-grant.ts and capability-request.ts already split theirs: sendRoomRekey is the pushing side (a thin wrapper over MeshSession.sendManageRequest), and createRoomRekeyHandler is the receiving side.
+*
+* The receiving side's own security property is worth stating plainly, since it's what makes this handler simpler than it might look: it needs no separate check of who actually sent the request. verifyRoomToken (obligation 1) already certifies that the recipient's OWN held room:member token's delegation chain terminates at the room's real, rightful owner -- deriving the ECDH shared secret against that certified owner's own rootIssuerKey means a wrapped-key only ever unwraps correctly when it was actually produced by someone holding the real owner's private key. A forged room.rekey from anyone else -- an attacker, a not-yet-admitted stranger, even another legitimate member with no admission authority -- cannot produce ciphertext that unwraps, so it fails closed on the cryptography itself rather than needing a redundant, separately-maintained live-sender identity check.
+*/
+/**
+* Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+*/
+function buildRoomRekeyCommand(keyEpoch, wrappedKey) {
+	return {
+		verb: require_domain_room_token_verification.ROOM_MEMBER_CAPABILITY,
+		params: {
+			verb: "room.rekey",
+			"key-epoch": keyEpoch,
+			"wrapped-key": wrappedKey
+		}
+	};
+}
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+async function sendRoomRekey(session, roomPath, keyEpoch, wrappedKey, targetDevice, token) {
+	return session.sendManageRequest(buildRoomRekeyCommand(keyEpoch, wrappedKey), {
+		kind: "room",
+		path: roomPath
+	}, targetDevice, token);
+}
+/**
+* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+*/
+function createRoomRekeyHandler(options) {
+	return async function handleRoomRekey(incoming) {
+		if (incoming.command.verb !== "room:member") {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		const parsed = require_generated_protocol.roomRekeySchema.safeParse(incoming.command.params);
+		if (!parsed.success) {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		if (incoming.scope.kind !== "room" || incoming.scope.path === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "scope_mismatch"
+			});
+			return;
+		}
+		const roomPath = incoming.scope.path;
+		const verdict = await require_domain_room_token_verification.verifyRoomToken(options.ownRoomMemberToken, {
+			identity: options.identity,
+			clock: options.clock,
+			revocation: options.revocation,
+			expectedBearer: options.identity.deviceId,
+			roomPath
+		});
+		if (!verdict.ok) {
+			await incoming.respond({
+				result: "error",
+				code: verdict.reason
+			});
+			return;
+		}
+		const deriveSharedSecret = options.identity.deriveSharedSecret;
+		if (deriveSharedSecret === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "ecdh_unsupported"
+			});
+			return;
+		}
+		const keyEpoch = parsed.data["key-epoch"];
+		const wrappedKeys = Array.isArray(parsed.data["wrapped-key"]) ? parsed.data["wrapped-key"] : [parsed.data["wrapped-key"]];
+		const firstEpoch = keyEpoch - wrappedKeys.length + 1;
+		let contentKeys;
+		try {
+			const sharedSecret = await deriveSharedSecret(verdict.rootIssuerKey);
+			contentKeys = await Promise.all(wrappedKeys.map(async (wrapped, i) => {
+				const wrappingKey = await require_domain_group_key.deriveWrappingKey(sharedSecret, {
+					room: roomPath,
+					keyEpoch: firstEpoch + i
+				});
+				return require_domain_group_key.unwrapContentKey(wrappingKey, wrapped);
+			}));
+		} catch {
+			await incoming.respond({
+				result: "error",
+				code: "unwrap_failed"
+			});
+			return;
+		}
+		await incoming.respond({ result: "ok" });
+		options.onRekey({
+			room: roomPath,
+			keyEpoch,
+			contentKeys
+		});
+	};
+}
+//#endregion
+exports.buildRoomRekeyCommand = buildRoomRekeyCommand;
+exports.createRoomRekeyHandler = createRoomRekeyHandler;
+exports.sendRoomRekey = sendRoomRekey;

package/dist/domain/room-rekey.d.cts

@@ -0,0 +1,35 @@
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
+import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
+import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
+import { a as RevocationCheck } from "../tokens-C9Kwy0Gk.cjs";
+//#region src/domain/room-rekey.d.ts
+/**
+ * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+ */
+export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+/** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
+export interface RoomRekeyEvent {
+  room: string;
+  /** The highest epoch this room.rekey granted -- the same value the wire message itself carried. */
+  keyEpoch: number;
+  /** contentKeys[i] is the content-encryption key for epoch i+1, matching wrapped-key's own array-ordering convention (spec/room.cddl) -- always at least one entry (the current epoch), even under the default single-bstr, members-at-the-time policy. */
+  contentKeys: readonly Uint8Array[];
+}
+export interface CreateRoomRekeyHandlerOptions {
+  /** This recipient's own identity -- both the verification primitives ownRoomMemberToken is checked with, and (via deriveSharedSecret) the ECDH half of unwrapping. */
+  identity: IdentityPort;
+  clock: Clock;
+  revocation: RevocationCheck;
+  /** This recipient's own currently-held room:member token for the room being rekeyed, verified fresh on every incoming room.rekey (not cached) -- see this module's own doc comment for why its certified root issuer-key is what the ECDH derivation uses, rather than a separately-tracked live-sender identity. */
+  ownRoomMemberToken: CapabilityToken;
+  /** Called once per successfully unwrapped room.rekey. */
+  onRekey: (event: Readonly<RoomRekeyEvent>) => void;
+}
+/**
+ * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+ */
+export declare function createRoomRekeyHandler(options: Readonly<CreateRoomRekeyHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
+//#endregion

package/dist/domain/room-rekey.d.mts

@@ -0,0 +1,35 @@
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
+import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
+import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
+import { a as RevocationCheck } from "../tokens-k172l0Iy.mjs";
+//#region src/domain/room-rekey.d.ts
+/**
+ * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+ */
+export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+/** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
+export interface RoomRekeyEvent {
+  room: string;
+  /** The highest epoch this room.rekey granted -- the same value the wire message itself carried. */
+  keyEpoch: number;
+  /** contentKeys[i] is the content-encryption key for epoch i+1, matching wrapped-key's own array-ordering convention (spec/room.cddl) -- always at least one entry (the current epoch), even under the default single-bstr, members-at-the-time policy. */
+  contentKeys: readonly Uint8Array[];
+}
+export interface CreateRoomRekeyHandlerOptions {
+  /** This recipient's own identity -- both the verification primitives ownRoomMemberToken is checked with, and (via deriveSharedSecret) the ECDH half of unwrapping. */
+  identity: IdentityPort;
+  clock: Clock;
+  revocation: RevocationCheck;
+  /** This recipient's own currently-held room:member token for the room being rekeyed, verified fresh on every incoming room.rekey (not cached) -- see this module's own doc comment for why its certified root issuer-key is what the ECDH derivation uses, rather than a separately-tracked live-sender identity. */
+  ownRoomMemberToken: CapabilityToken;
+  /** Called once per successfully unwrapped room.rekey. */
+  onRekey: (event: Readonly<RoomRekeyEvent>) => void;
+}
+/**
+ * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+ */
+export declare function createRoomRekeyHandler(options: Readonly<CreateRoomRekeyHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
+//#endregion

package/dist/domain/room-rekey.mjs

@@ -0,0 +1,109 @@
+import { roomRekeySchema } from "../generated/protocol.mjs";
+import { deriveWrappingKey, unwrapContentKey } from "./group-key.mjs";
+import { ROOM_MEMBER_CAPABILITY, verifyRoomToken } from "./room-token-verification.mjs";
+//#region src/domain/room-rekey.ts
+/**
+* room.rekey (wire-mesh#141, spec/room.cddl): distributes and rotates a room's symmetric content-encryption key. Two responsibilities, split the same way capability-grant.ts and capability-request.ts already split theirs: sendRoomRekey is the pushing side (a thin wrapper over MeshSession.sendManageRequest), and createRoomRekeyHandler is the receiving side.
+*
+* The receiving side's own security property is worth stating plainly, since it's what makes this handler simpler than it might look: it needs no separate check of who actually sent the request. verifyRoomToken (obligation 1) already certifies that the recipient's OWN held room:member token's delegation chain terminates at the room's real, rightful owner -- deriving the ECDH shared secret against that certified owner's own rootIssuerKey means a wrapped-key only ever unwraps correctly when it was actually produced by someone holding the real owner's private key. A forged room.rekey from anyone else -- an attacker, a not-yet-admitted stranger, even another legitimate member with no admission authority -- cannot produce ciphertext that unwraps, so it fails closed on the cryptography itself rather than needing a redundant, separately-maintained live-sender identity check.
+*/
+/**
+* Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
+*/
+function buildRoomRekeyCommand(keyEpoch, wrappedKey) {
+	return {
+		verb: ROOM_MEMBER_CAPABILITY,
+		params: {
+			verb: "room.rekey",
+			"key-epoch": keyEpoch,
+			"wrapped-key": wrappedKey
+		}
+	};
+}
+/** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
+async function sendRoomRekey(session, roomPath, keyEpoch, wrappedKey, targetDevice, token) {
+	return session.sendManageRequest(buildRoomRekeyCommand(keyEpoch, wrappedKey), {
+		kind: "room",
+		path: roomPath
+	}, targetDevice, token);
+}
+/**
+* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+*/
+function createRoomRekeyHandler(options) {
+	return async function handleRoomRekey(incoming) {
+		if (incoming.command.verb !== "room:member") {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		const parsed = roomRekeySchema.safeParse(incoming.command.params);
+		if (!parsed.success) {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		if (incoming.scope.kind !== "room" || incoming.scope.path === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "scope_mismatch"
+			});
+			return;
+		}
+		const roomPath = incoming.scope.path;
+		const verdict = await verifyRoomToken(options.ownRoomMemberToken, {
+			identity: options.identity,
+			clock: options.clock,
+			revocation: options.revocation,
+			expectedBearer: options.identity.deviceId,
+			roomPath
+		});
+		if (!verdict.ok) {
+			await incoming.respond({
+				result: "error",
+				code: verdict.reason
+			});
+			return;
+		}
+		const deriveSharedSecret = options.identity.deriveSharedSecret;
+		if (deriveSharedSecret === void 0) {
+			await incoming.respond({
+				result: "error",
+				code: "ecdh_unsupported"
+			});
+			return;
+		}
+		const keyEpoch = parsed.data["key-epoch"];
+		const wrappedKeys = Array.isArray(parsed.data["wrapped-key"]) ? parsed.data["wrapped-key"] : [parsed.data["wrapped-key"]];
+		const firstEpoch = keyEpoch - wrappedKeys.length + 1;
+		let contentKeys;
+		try {
+			const sharedSecret = await deriveSharedSecret(verdict.rootIssuerKey);
+			contentKeys = await Promise.all(wrappedKeys.map(async (wrapped, i) => {
+				const wrappingKey = await deriveWrappingKey(sharedSecret, {
+					room: roomPath,
+					keyEpoch: firstEpoch + i
+				});
+				return unwrapContentKey(wrappingKey, wrapped);
+			}));
+		} catch {
+			await incoming.respond({
+				result: "error",
+				code: "unwrap_failed"
+			});
+			return;
+		}
+		await incoming.respond({ result: "ok" });
+		options.onRekey({
+			room: roomPath,
+			keyEpoch,
+			contentKeys
+		});
+	};
+}
+//#endregion
+export { buildRoomRekeyCommand, createRoomRekeyHandler, sendRoomRekey };

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**
@@ -35,7 +35,8 @@ async function verifyRoomToken(token, options) {
 	};
 	return {
 		ok: true,
-		claims: verdict.claims
+		claims: verdict.claims,
+		rootIssuerKey: verdict.rootIssuerKey
 	};
 }
 //#endregion

package/dist/domain/room-token-verification.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, It as TokenClaims, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-CNQirfHi.cjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, p as CapabilityToken } from "../protocol-gbXtNeOc.cjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-C9Kwy0Gk.cjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";
@@ -7,6 +7,8 @@ export type RoomTokenVerdictReason = TokenVerdictReason | "wrong_scope_kind" | "
 export type RoomTokenVerdict = {
   ok: true;
   claims: TokenClaims;
+  /** The chain's own certified root issuer-key -- for a named room, this is exactly the room's rightful owner (obligation 1 just confirmed the chain terminates there), and for a DM it's the verifying identity's own key. Lets a caller (e.g. room.rekey's own handler) derive an ECDH shared secret against the room's real owner with no separate live-sender identity check needed. */
+  rootIssuerKey: IdentityKey;
 } | {
   ok: false;
   reason: RoomTokenVerdictReason;

package/dist/domain/room-token-verification.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, It as TokenClaims, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-C_LvOuYO.mjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, p as CapabilityToken } from "../protocol-gbXtNeOc.mjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-k172l0Iy.mjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";
@@ -7,6 +7,8 @@ export type RoomTokenVerdictReason = TokenVerdictReason | "wrong_scope_kind" | "
 export type RoomTokenVerdict = {
   ok: true;
   claims: TokenClaims;
+  /** The chain's own certified root issuer-key -- for a named room, this is exactly the room's rightful owner (obligation 1 just confirmed the chain terminates there), and for a DM it's the verifying identity's own key. Lets a caller (e.g. room.rekey's own handler) derive an ECDH shared secret against the room's real owner with no separate live-sender identity check needed. */
+  rootIssuerKey: IdentityKey;
 } | {
   ok: false;
   reason: RoomTokenVerdictReason;

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
 import { deviceIdToHex } from "./device-id.mjs";
-import { i as verifyCapabilityToken } from "../tokens-VicRWTj1.mjs";
+import { i as verifyCapabilityToken } from "../tokens-CdQwzCyJ.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**
@@ -34,7 +34,8 @@ async function verifyRoomToken(token, options) {
 	};
 	return {
 		ok: true,
-		claims: verdict.claims
+		claims: verdict.claims,
+		rootIssuerKey: verdict.rootIssuerKey
 	};
 }
 //#endregion

package/dist/domain/room.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
+const require_domain_group_key = require("./group-key.cjs");
 const require_domain_room_token_verification = require("./room-token-verification.cjs");
 let cbor2 = require("cbor2");
 //#region src/domain/room.ts
@@ -91,6 +92,11 @@ async function verifyRoomNotice(notice, options) {
 		ok: false,
 		reason: "content_expired"
 	};
+	const keyEpoch = claims["key-epoch"];
+	if (require_domain_group_key.isEncryptedContentType(claims["content-type"]) !== (keyEpoch !== void 0)) return {
+		ok: false,
+		reason: "key_epoch_mismatch"
+	};
 	const tokenVerdict = await require_domain_room_token_verification.verifyRoomToken(claims.token, {
 		identity: options.identity,
 		clock: options.clock,
@@ -130,7 +136,8 @@ async function createRoomNotice(options) {
 		"content-type": options.contentType,
 		content: options.content,
 		...options.refs !== void 0 ? { refs: [...options.refs] } : {},
-		...options.validUntil !== void 0 ? { "valid-until": options.validUntil } : {}
+		...options.validUntil !== void 0 ? { "valid-until": options.validUntil } : {},
+		...options.keyEpoch !== void 0 ? { "key-epoch": options.keyEpoch } : {}
 	});
 	const protectedHeader = protectedHeaderFor(options.identity);
 	return [

package/dist/domain/room.d.cts

@@ -1,10 +1,10 @@
 import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-gbXtNeOc.cjs";
 import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-CNQirfHi.cjs";
+import { a as RevocationCheck } from "../tokens-C9Kwy0Gk.cjs";
 import { RoomTokenVerdictReason } from "./room-token-verification.cjs";
 //#region src/domain/room.d.ts
-export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | RoomTokenVerdictReason;
+export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {
   ok: true;
   claims: RoomNoticeClaims;
@@ -45,6 +45,8 @@ export interface CreateRoomNoticeOptions {
   content: Uint8Array<ArrayBuffer>;
   refs?: readonly MessageRef[];
   validUntil?: number;
+  /** Which room.rekey epoch content is encrypted under (wire-mesh#141), present iff content-type names an encrypted content-type -- see room-notice-claims' own obligation 7 comment in room.cddl. This function does not itself encrypt content: the caller encrypts via group-key.ts's encryptNoticeContent beforehand and passes the resulting ciphertext as content, exactly as it would pass any other opaque bytes. */
+  keyEpoch?: number;
 }
 /**
  * Mints one self-certifying room-notice as `identity` -- the counterpart to verifyRoomNotice above, producing exactly what it accepts. `posted-at` is always stamped from the injected clock, never caller-supplied, matching obligation 4's own requirement that a poster's own log stay non-decreasing: a caller backdating its own posted-at would be indistinguishable from a clock bug at mint time, so this function simply doesn't expose the field to override.

package/dist/domain/room.d.mts

@@ -1,10 +1,10 @@
 import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-gbXtNeOc.mjs";
 import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-C_LvOuYO.mjs";
+import { a as RevocationCheck } from "../tokens-k172l0Iy.mjs";
 import { RoomTokenVerdictReason } from "./room-token-verification.mjs";
 //#region src/domain/room.d.ts
-export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | RoomTokenVerdictReason;
+export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {
   ok: true;
   claims: RoomNoticeClaims;
@@ -45,6 +45,8 @@ export interface CreateRoomNoticeOptions {
   content: Uint8Array<ArrayBuffer>;
   refs?: readonly MessageRef[];
   validUntil?: number;
+  /** Which room.rekey epoch content is encrypted under (wire-mesh#141), present iff content-type names an encrypted content-type -- see room-notice-claims' own obligation 7 comment in room.cddl. This function does not itself encrypt content: the caller encrypts via group-key.ts's encryptNoticeContent beforehand and passes the resulting ciphertext as content, exactly as it would pass any other opaque bytes. */
+  keyEpoch?: number;
 }
 /**
  * Mints one self-certifying room-notice as `identity` -- the counterpart to verifyRoomNotice above, producing exactly what it accepts. `posted-at` is always stamped from the injected clock, never caller-supplied, matching obligation 4's own requirement that a poster's own log stay non-decreasing: a caller backdating its own posted-at would be indistinguishable from a clock bug at mint time, so this function simply doesn't expose the field to override.

package/dist/domain/room.mjs

@@ -1,4 +1,5 @@
 import { roomNoticeClaimsSchema } from "../generated/protocol.mjs";
+import { isEncryptedContentType } from "./group-key.mjs";
 import { verifyRoomToken } from "./room-token-verification.mjs";
 import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
 //#region src/domain/room.ts
@@ -90,6 +91,11 @@ async function verifyRoomNotice(notice, options) {
 		ok: false,
 		reason: "content_expired"
 	};
+	const keyEpoch = claims["key-epoch"];
+	if (isEncryptedContentType(claims["content-type"]) !== (keyEpoch !== void 0)) return {
+		ok: false,
+		reason: "key_epoch_mismatch"
+	};
 	const tokenVerdict = await verifyRoomToken(claims.token, {
 		identity: options.identity,
 		clock: options.clock,
@@ -129,7 +135,8 @@ async function createRoomNotice(options) {
 		"content-type": options.contentType,
 		content: options.content,
 		...options.refs !== void 0 ? { refs: [...options.refs] } : {},
-		...options.validUntil !== void 0 ? { "valid-until": options.validUntil } : {}
+		...options.validUntil !== void 0 ? { "valid-until": options.validUntil } : {},
+		...options.keyEpoch !== void 0 ? { "key-epoch": options.keyEpoch } : {}
 	});
 	const protectedHeader = protectedHeaderFor(options.identity);
 	return [

package/dist/domain/tokens.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-CiNXdKJ8.cjs");
+const require_tokens = require("../tokens-DxGVURpB.cjs");
 exports.canGrant = require_tokens.canGrant;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CNQirfHi.cjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-C9Kwy0Gk.cjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-C_LvOuYO.mjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-k172l0Iy.mjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-VicRWTj1.mjs";
+import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-CdQwzCyJ.mjs";
 export { canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/{tokens-CNQirfHi.d.cts → tokens-C9Kwy0Gk.d.cts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, It as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-gbXtNeOc.cjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-gbXtNeOc.cjs";
 import { t as IdentityPort } from "./identity-B4XBWkqg.cjs";
 import { t as Clock } from "./clock-DiSx-WKM.cjs";
 import { z } from "zod";
@@ -36,6 +36,8 @@ type TokenVerdict = {
   claims: TokenClaims;
   /** The device-id at the root of this token's delegation chain: its own issuer when it carries no parent, otherwise the root of its parent's chain. Lets a caller (e.g. core/room's obligation that a chain must terminate at the path's own owner, or the verifier itself for a DM) check the chain's root with one equality comparison instead of re-walking the parent chain a second time. */
   rootIssuer: DeviceId;
+  /** The root ancestor's own self-certifying issuer-key -- already decoded during the walk (every TokenClaims carries its own issuer-key), just threaded up rather than re-derived. Lets a caller compute an ECDH shared secret against the chain's root (e.g. room.rekey's own sender, for a named room whose token chain terminates at the owner) without a separate, out-of-band way to learn that issuer's public key. */
+  rootIssuerKey: IdentityKey;
   /** How many delegation hops this token is from its own root -- 0 for a root grant. Costs nothing extra once rootIssuer is being tracked, and makes the delegation bound observable for diagnostics. */
   depth: number;
 } | {

package/dist/{tokens-VicRWTj1.mjs → tokens-CdQwzCyJ.mjs}

@@ -310,6 +310,7 @@ async function verifyTokenChain(token, options) {
 			ok: true,
 			claims,
 			rootIssuer: parentVerdict.rootIssuer,
+			rootIssuerKey: parentVerdict.rootIssuerKey,
 			depth: parentVerdict.depth + 1
 		};
 	}
@@ -317,6 +318,7 @@ async function verifyTokenChain(token, options) {
 		ok: true,
 		claims,
 		rootIssuer: claims.issuer,
+		rootIssuerKey: claims["issuer-key"],
 		depth: 0
 	};
 }

package/dist/{tokens-CiNXdKJ8.cjs → tokens-DxGVURpB.cjs}

@@ -310,6 +310,7 @@ async function verifyTokenChain(token, options) {
 			ok: true,
 			claims,
 			rootIssuer: parentVerdict.rootIssuer,
+			rootIssuerKey: parentVerdict.rootIssuerKey,
 			depth: parentVerdict.depth + 1
 		};
 	}
@@ -317,6 +318,7 @@ async function verifyTokenChain(token, options) {
 		ok: true,
 		claims,
 		rootIssuer: claims.issuer,
+		rootIssuerKey: claims["issuer-key"],
 		depth: 0
 	};
 }

package/dist/{tokens-C_LvOuYO.d.mts → tokens-k172l0Iy.d.mts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, It as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-gbXtNeOc.mjs";
+import { B as IdentityKey, D as DeviceId, It as TokenClaims, _t as RevocationEntry, gt as RevocationClaims, p as CapabilityToken } from "./protocol-gbXtNeOc.mjs";
 import { t as IdentityPort } from "./identity-CIb9dGkJ.mjs";
 import { t as Clock } from "./clock-DiSx-WKM.mjs";
 import { z } from "zod";
@@ -36,6 +36,8 @@ type TokenVerdict = {
   claims: TokenClaims;
   /** The device-id at the root of this token's delegation chain: its own issuer when it carries no parent, otherwise the root of its parent's chain. Lets a caller (e.g. core/room's obligation that a chain must terminate at the path's own owner, or the verifier itself for a DM) check the chain's root with one equality comparison instead of re-walking the parent chain a second time. */
   rootIssuer: DeviceId;
+  /** The root ancestor's own self-certifying issuer-key -- already decoded during the walk (every TokenClaims carries its own issuer-key), just threaded up rather than re-derived. Lets a caller compute an ECDH shared secret against the chain's root (e.g. room.rekey's own sender, for a named room whose token chain terminates at the owner) without a separate, out-of-band way to learn that issuer's public key. */
+  rootIssuerKey: IdentityKey;
   /** How many delegation hops this token is from its own root -- 0 for a root grant. Costs nothing extra once rootIssuer is being tracked, and makes the delegation bound observable for diagnostics. */
   depth: number;
 } | {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.32.0",
+  "version": "1.34.0",
   "type": "module",
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {
@@ -146,6 +146,10 @@
       "import": "./dist/domain/room-path.mjs",
       "require": "./dist/domain/room-path.cjs"
     },
+    "./domain/room-rekey": {
+      "import": "./dist/domain/room-rekey.mjs",
+      "require": "./dist/domain/room-rekey.cjs"
+    },
     "./domain/room-token-verification": {
       "import": "./dist/domain/room-token-verification.mjs",
       "require": "./dist/domain/room-token-verification.cjs"