wire-mesh-core 1.38.0 → 1.40.0

package/dist/domain/room-rekey.cjs

@@ -61,7 +61,8 @@ function createRoomRekeyHandler(options) {
 			clock: options.clock,
 			revocation: options.revocation,
 			expectedBearer: options.identity.deviceId,
-			roomPath
+			roomPath,
+			dmRootPolicy: "either-participant"
 		});
 		if (!verdict.ok) {
 			await incoming.respond({

package/dist/domain/room-rekey.mjs

@@ -60,7 +60,8 @@ function createRoomRekeyHandler(options) {
 			clock: options.clock,
 			revocation: options.revocation,
 			expectedBearer: options.identity.deviceId,
-			roomPath
+			roomPath,
+			dmRootPolicy: "either-participant"
 		});
 		if (!verdict.ok) {
 			await incoming.respond({

package/dist/domain/room-token-verification.cjs

@@ -28,8 +28,18 @@ async function verifyRoomToken(token, options) {
 		reason: "wrong_scope_path"
 	};
 	const parsed = require_domain_room_path.parseRoomPath(options.roomPath);
-	const expectedRootHex = parsed.kind === "owner-named" ? parsed.owner : require_domain_device_id.deviceIdToHex(options.identity.deviceId);
-	if (require_domain_device_id.deviceIdToHex(verdict.rootIssuer) !== expectedRootHex) return {
+	const rootHex = require_domain_device_id.deviceIdToHex(verdict.rootIssuer);
+	if (parsed.kind === "owner-named") {
+		if (rootHex !== parsed.owner) return {
+			ok: false,
+			reason: "wrong_chain_root"
+		};
+	} else if (options.dmRootPolicy === "either-participant") {
+		if (rootHex !== parsed.participants[0] && rootHex !== parsed.participants[1]) return {
+			ok: false,
+			reason: "wrong_chain_root"
+		};
+	} else if (rootHex !== require_domain_device_id.deviceIdToHex(options.identity.deviceId)) return {
 		ok: false,
 		reason: "wrong_chain_root"
 	};

package/dist/domain/room-token-verification.d.cts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-BY9AwZQ-.cjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CkQV0Iq7.cjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.d.mts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CYKEP_h6.mjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-BggPfYr8.mjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.mjs

@@ -27,8 +27,18 @@ async function verifyRoomToken(token, options) {
 		reason: "wrong_scope_path"
 	};
 	const parsed = parseRoomPath(options.roomPath);
-	const expectedRootHex = parsed.kind === "owner-named" ? parsed.owner : deviceIdToHex(options.identity.deviceId);
-	if (deviceIdToHex(verdict.rootIssuer) !== expectedRootHex) return {
+	const rootHex = deviceIdToHex(verdict.rootIssuer);
+	if (parsed.kind === "owner-named") {
+		if (rootHex !== parsed.owner) return {
+			ok: false,
+			reason: "wrong_chain_root"
+		};
+	} else if (options.dmRootPolicy === "either-participant") {
+		if (rootHex !== parsed.participants[0] && rootHex !== parsed.participants[1]) return {
+			ok: false,
+			reason: "wrong_chain_root"
+		};
+	} else if (rootHex !== deviceIdToHex(options.identity.deviceId)) return {
 		ok: false,
 		reason: "wrong_chain_root"
 	};

package/dist/domain/room.d.cts

@@ -2,7 +2,7 @@ import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as Capabili
 import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { a as RevocationCheck } from "../tokens-C9Kwy0Gk.cjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-BY9AwZQ-.cjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-CkQV0Iq7.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/room.d.mts

@@ -2,7 +2,7 @@ import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as Capabili
 import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { a as RevocationCheck } from "../tokens-k172l0Iy.mjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-CYKEP_h6.mjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-BggPfYr8.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/{room-token-verification-CYKEP_h6.d.mts → room-token-verification-BggPfYr8.d.mts}

@@ -18,6 +18,21 @@ interface VerifyRoomTokenOptions extends Omit<VerifyCapabilityTokenOptions, "exp
   expectedBearer: DeviceId;
   /** The room path this request claims to act on (obligation 3) -- must equal the token's own scope.path, and its own shape determines the chain root obligation 1 requires. */
   roomPath: string;
+  /**
+   * Whose root a DM token's chain may terminate at. "self" (the default) is
+   * the room.send-grade rule: the verifier itself, never either named
+   * participant directly, since a DM token minted by anyone else would let a
+   * sender self-issue authority to message a stranger unsolicited.
+   * "either-participant" relaxes it to EITHER device named in the DM path --
+   * valid only where the caller's own security does not rest on the root rule
+   * itself. room.rekey is that caller: in a DM each participant's own held
+   * token chains to the OTHER side (I approve your join, minting a grant
+   * rooted at me, held by you), so the strict rule can never pass, and the
+   * handler's actual binding is the ECDH unwrap -- a forged rekey needs the
+   * root's private key to produce unwrappable ciphertext -- not the root
+   * check. A root outside the path is refused under either policy.
+   */
+  dmRootPolicy?: "self" | "either-participant";
 }
 /**
  * Verifies a `room:member` capability token against all six of core/room's verifier obligations. Delegates obligations 2/4/5 to verifyCapabilityToken directly; adds obligation 3 (scope.kind/scope.path must match the room being acted on) and obligation 1 (the chain's root must be the room's own owner for a named room, or the verifying identity itself for a DM -- never either named participant directly, since a DM token minted by anyone other than the verifier would let a sender self-issue authority to message a stranger unsolicited).

package/dist/{room-token-verification-BY9AwZQ-.d.cts → room-token-verification-CkQV0Iq7.d.cts}

@@ -18,6 +18,21 @@ interface VerifyRoomTokenOptions extends Omit<VerifyCapabilityTokenOptions, "exp
   expectedBearer: DeviceId;
   /** The room path this request claims to act on (obligation 3) -- must equal the token's own scope.path, and its own shape determines the chain root obligation 1 requires. */
   roomPath: string;
+  /**
+   * Whose root a DM token's chain may terminate at. "self" (the default) is
+   * the room.send-grade rule: the verifier itself, never either named
+   * participant directly, since a DM token minted by anyone else would let a
+   * sender self-issue authority to message a stranger unsolicited.
+   * "either-participant" relaxes it to EITHER device named in the DM path --
+   * valid only where the caller's own security does not rest on the root rule
+   * itself. room.rekey is that caller: in a DM each participant's own held
+   * token chains to the OTHER side (I approve your join, minting a grant
+   * rooted at me, held by you), so the strict rule can never pass, and the
+   * handler's actual binding is the ECDH unwrap -- a forged rekey needs the
+   * root's private key to produce unwrappable ciphertext -- not the root
+   * check. A root outside the path is refused under either policy.
+   */
+  dmRootPolicy?: "self" | "either-participant";
 }
 /**
  * Verifies a `room:member` capability token against all six of core/room's verifier obligations. Delegates obligations 2/4/5 to verifyCapabilityToken directly; adds obligation 3 (scope.kind/scope.path must match the room being acted on) and obligation 1 (the chain's root must be the room's own owner for a named room, or the verifying identity itself for a DM -- never either named participant directly, since a DM token minted by anyone other than the verifier would let a sender self-issue authority to message a stranger unsolicited).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.38.0",
+  "version": "1.40.0",
   "type": "module",
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {