wire-mesh-core 3.6.0 → 3.7.0

package/dist/domain/mesh-session.cjs

@@ -780,8 +780,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */

package/dist/domain/mesh-session.d.cts

@@ -81,7 +81,17 @@ export interface MeshSession {
   readonly coordinatorFrames: AsyncIterable<CoordinatorFrame>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
-  /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
+  /**
+   * Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives.
+   *
+   * The pairing is FIFO because ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's promise resolves against the Nth pong received after it, never matched by any other means.
+   *
+   * Rejects with a plain Error if the connection closes, and with a PingTimeoutError (from ping-round-trips.ts) when `timeoutMs` is given and no pong arrives within it, so a caller can tell an unanswered ping from a dropped connection. It never resolves a sentinel the way sendManageRequest's own timeout does, because there is no natural "no answer" value for a bare millisecond count to double as.
+   *
+   * Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong, which today means relay-hub's own frame handling (wire-mesh#181). Called against a plain peer that never sends pong it hangs until `timeoutMs` if given, or forever.
+   *
+   * It exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time it over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg.
+   */
   sendPingMeasureRtt: (timeoutMs?: number) => Promise<number>;
   /** Attaches this token to every `manage-request` sent from now on. */
   setToken: (token: CapabilityToken) => void;
@@ -103,7 +113,9 @@ export declare function createMeshSession(transport: Readonly<Transport>, identi
 /** This node's own directly-reachable "host:port" candidates (wire-mesh#38), advertised in this session's self-advert so other peers can attempt a direct connection instead of always falling back to a relay. Omit (or pass none) for a caller with nothing to offer, e.g. a browser client. */
 addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
-onPeerAdvert?: (advert: PeerAdvert) => void): MeshSession;
+onPeerAdvert?: (advert: PeerAdvert) => void,
+/** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.d.mts

@@ -81,7 +81,17 @@ export interface MeshSession {
   readonly coordinatorFrames: AsyncIterable<CoordinatorFrame>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
-  /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
+  /**
+   * Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives.
+   *
+   * The pairing is FIFO because ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's promise resolves against the Nth pong received after it, never matched by any other means.
+   *
+   * Rejects with a plain Error if the connection closes, and with a PingTimeoutError (from ping-round-trips.ts) when `timeoutMs` is given and no pong arrives within it, so a caller can tell an unanswered ping from a dropped connection. It never resolves a sentinel the way sendManageRequest's own timeout does, because there is no natural "no answer" value for a bare millisecond count to double as.
+   *
+   * Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong, which today means relay-hub's own frame handling (wire-mesh#181). Called against a plain peer that never sends pong it hangs until `timeoutMs` if given, or forever.
+   *
+   * It exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time it over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg.
+   */
   sendPingMeasureRtt: (timeoutMs?: number) => Promise<number>;
   /** Attaches this token to every `manage-request` sent from now on. */
   setToken: (token: CapabilityToken) => void;
@@ -103,7 +113,9 @@ export declare function createMeshSession(transport: Readonly<Transport>, identi
 /** This node's own directly-reachable "host:port" candidates (wire-mesh#38), advertised in this session's self-advert so other peers can attempt a direct connection instead of always falling back to a relay. Omit (or pass none) for a caller with nothing to offer, e.g. a browser client. */
 addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
-onPeerAdvert?: (advert: PeerAdvert) => void): MeshSession;
+onPeerAdvert?: (advert: PeerAdvert) => void,
+/** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.mjs

@@ -779,8 +779,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */

package/dist/domain/notice-board.cjs

@@ -56,13 +56,13 @@ function createNoticeBoard(options) {
 			entries: [entry]
 		})).ok) throw new Error(`gap rejecting entry for peer log (head ${String(fromSeq)})`);
 	}
-	async function readLog(peer, room) {
+	async function readLog(peer, room, dmRootPolicy) {
 		const entries = await require_domain_data_sync.readEntries(storage, peer, 0);
 		const out = [];
-		for (const entry of entries) out.push(await readOne(entry, room));
+		for (const entry of entries) out.push(await readOne(entry, room, dmRootPolicy));
 		return out;
 	}
-	async function readOne(entry, room) {
+	async function readOne(entry, room, dmRootPolicy) {
 		const notice = decodeNotice(entry);
 		if (notice === void 0) return {
 			verified: false,
@@ -72,7 +72,8 @@ function createNoticeBoard(options) {
 			identity,
 			clock,
 			revocation,
-			expectedRoom: room
+			expectedRoom: room,
+			dmRootPolicy
 		});
 		if (!verdict.ok) return {
 			verified: false,
@@ -119,8 +120,8 @@ function createNoticeBoard(options) {
 	return {
 		postEncryptedNotice,
 		ingestPeerEntry,
-		readOwnNotices: async (room) => readLog(identity.deviceId, room),
-		readPeerNotices: async (peer, room) => readLog(peer, room)
+		readOwnNotices: async (room) => readLog(identity.deviceId, room, "either-participant"),
+		readPeerNotices: async (peer, room) => readLog(peer, room, "self")
 	};
 }
 //#endregion

package/dist/domain/notice-board.mjs

@@ -55,13 +55,13 @@ function createNoticeBoard(options) {
 			entries: [entry]
 		})).ok) throw new Error(`gap rejecting entry for peer log (head ${String(fromSeq)})`);
 	}
-	async function readLog(peer, room) {
+	async function readLog(peer, room, dmRootPolicy) {
 		const entries = await readEntries(storage, peer, 0);
 		const out = [];
-		for (const entry of entries) out.push(await readOne(entry, room));
+		for (const entry of entries) out.push(await readOne(entry, room, dmRootPolicy));
 		return out;
 	}
-	async function readOne(entry, room) {
+	async function readOne(entry, room, dmRootPolicy) {
 		const notice = decodeNotice(entry);
 		if (notice === void 0) return {
 			verified: false,
@@ -71,7 +71,8 @@ function createNoticeBoard(options) {
 			identity,
 			clock,
 			revocation,
-			expectedRoom: room
+			expectedRoom: room,
+			dmRootPolicy
 		});
 		if (!verdict.ok) return {
 			verified: false,
@@ -118,8 +119,8 @@ function createNoticeBoard(options) {
 	return {
 		postEncryptedNotice,
 		ingestPeerEntry,
-		readOwnNotices: async (room) => readLog(identity.deviceId, room),
-		readPeerNotices: async (peer, room) => readLog(peer, room)
+		readOwnNotices: async (room) => readLog(identity.deviceId, room, "either-participant"),
+		readPeerNotices: async (peer, room) => readLog(peer, room, "self")
 	};
 }
 //#endregion

package/dist/domain/ping-round-trips.cjs

@@ -1,5 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/domain/ping-round-trips.ts
+/** Why a ping was given up on: no pong arrived within the caller's `timeoutMs`. A call rejected for any other reason (the connection dropped or closed first) rejects with a plain Error, so a caller counting unanswered pings tells the two apart by this class rather than by message text. */
+var PingTimeoutError = class extends Error {
+	constructor() {
+		super("timed out waiting for pong");
+		this.name = "PingTimeoutError";
+	}
+};
 function createPingRoundTrips() {
 	const pending = [];
 	function cancel(sentAt) {
@@ -28,11 +35,12 @@ function createPingRoundTrips() {
 			if (timeoutMs === void 0) return rtt;
 			return Promise.race([rtt, new Promise((_resolve, reject) => {
 				setTimeout(() => {
-					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
+					if (cancel(sentAt)) reject(new PingTimeoutError());
 				}, timeoutMs);
 			})]);
 		}
 	};
 }
 //#endregion
+exports.PingTimeoutError = PingTimeoutError;
 exports.createPingRoundTrips = createPingRoundTrips;

package/dist/domain/ping-round-trips.d.cts

@@ -1,4 +1,8 @@
 //#region src/domain/ping-round-trips.d.ts
+/** Why a ping was given up on: no pong arrived within the caller's `timeoutMs`. A call rejected for any other reason (the connection dropped or closed first) rejects with a plain Error, so a caller counting unanswered pings tells the two apart by this class rather than by message text. */
+export declare class PingTimeoutError extends Error {
+  constructor();
+}
 export interface PingRoundTrips {
   /** Resolves the oldest still-pending call with (nowMs - itsOwnSentAt) -- called once per pong-frame received. A no-op if nothing is pending (a stray pong with no outstanding call). */
   resolveOldest: (nowMs: number) => void;

package/dist/domain/ping-round-trips.d.mts

@@ -1,4 +1,8 @@
 //#region src/domain/ping-round-trips.d.ts
+/** Why a ping was given up on: no pong arrived within the caller's `timeoutMs`. A call rejected for any other reason (the connection dropped or closed first) rejects with a plain Error, so a caller counting unanswered pings tells the two apart by this class rather than by message text. */
+export declare class PingTimeoutError extends Error {
+  constructor();
+}
 export interface PingRoundTrips {
   /** Resolves the oldest still-pending call with (nowMs - itsOwnSentAt) -- called once per pong-frame received. A no-op if nothing is pending (a stray pong with no outstanding call). */
   resolveOldest: (nowMs: number) => void;

package/dist/domain/ping-round-trips.mjs

@@ -1,4 +1,11 @@
 //#region src/domain/ping-round-trips.ts
+/** Why a ping was given up on: no pong arrived within the caller's `timeoutMs`. A call rejected for any other reason (the connection dropped or closed first) rejects with a plain Error, so a caller counting unanswered pings tells the two apart by this class rather than by message text. */
+var PingTimeoutError = class extends Error {
+	constructor() {
+		super("timed out waiting for pong");
+		this.name = "PingTimeoutError";
+	}
+};
 function createPingRoundTrips() {
 	const pending = [];
 	function cancel(sentAt) {
@@ -27,11 +34,11 @@ function createPingRoundTrips() {
 			if (timeoutMs === void 0) return rtt;
 			return Promise.race([rtt, new Promise((_resolve, reject) => {
 				setTimeout(() => {
-					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
+					if (cancel(sentAt)) reject(new PingTimeoutError());
 				}, timeoutMs);
 			})]);
 		}
 	};
 }
 //#endregion
-export { createPingRoundTrips };
+export { PingTimeoutError, createPingRoundTrips };

package/dist/domain/room-rekey.d.cts

@@ -9,7 +9,7 @@ import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
  */
 export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
 /** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
-export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+export declare function sendRoomRekey(session: Readonly<Pick<MeshSession, "sendManageRequest">>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
 /** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
 export interface RoomRekeyEvent {
   room: string;

package/dist/domain/room-rekey.d.mts

@@ -9,7 +9,7 @@ import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
  */
 export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
 /** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
-export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+export declare function sendRoomRekey(session: Readonly<Pick<MeshSession, "sendManageRequest">>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
 /** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
 export interface RoomRekeyEvent {
   room: string;

package/dist/domain/room.cjs

@@ -102,7 +102,8 @@ async function verifyRoomNotice(notice, options) {
 		clock: options.clock,
 		revocation: options.revocation,
 		expectedBearer: claims.poster,
-		roomPath: claims.room
+		roomPath: claims.room,
+		...options.dmRootPolicy !== void 0 ? { dmRootPolicy: options.dmRootPolicy } : {}
 	});
 	if (!tokenVerdict.ok) return {
 		ok: false,

package/dist/domain/room.d.cts

@@ -20,6 +20,10 @@ export interface VerifyRoomNoticeOptions {
    * When given, refuses any notice not claiming exactly this room -- "is this the room I actually asked to read", checked against the notice's own self-declared `room` field before any cryptographic work, so a caller scanning a mixed stream of notices can cheaply skip ones for other rooms. Independent of, and layered on top of, this function's own unconditional internal self-consistency check (the embedded token's scope.path MUST equal the notice's own `room` field regardless of whether expectedRoom is given at all) -- a notice can be internally self-consistent yet still be for a room other than the one a caller expected, and this is the option that catches that case. Mirrors verifyCapabilityToken's own optional expectedBearer for the same "also assert it matches what I expected" shape.
    */
   expectedRoom?: RoomPath;
+  /**
+   * How a DM's embedded token must be rooted, passed to verifyRoomToken (see its own `dmRootPolicy`). The default requires the root to be the verifying identity, which is right for a notice another device posted to me. A device reading its own notice holds a token rooted at the other participant, so only "either-participant" can pass there; it is safe because nothing about an own notice rests on the root rule, the device wrote it.
+   */
+  dmRootPolicy?: "self" | "either-participant";
 }
 /**
  * Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.

package/dist/domain/room.d.mts

@@ -20,6 +20,10 @@ export interface VerifyRoomNoticeOptions {
    * When given, refuses any notice not claiming exactly this room -- "is this the room I actually asked to read", checked against the notice's own self-declared `room` field before any cryptographic work, so a caller scanning a mixed stream of notices can cheaply skip ones for other rooms. Independent of, and layered on top of, this function's own unconditional internal self-consistency check (the embedded token's scope.path MUST equal the notice's own `room` field regardless of whether expectedRoom is given at all) -- a notice can be internally self-consistent yet still be for a room other than the one a caller expected, and this is the option that catches that case. Mirrors verifyCapabilityToken's own optional expectedBearer for the same "also assert it matches what I expected" shape.
    */
   expectedRoom?: RoomPath;
+  /**
+   * How a DM's embedded token must be rooted, passed to verifyRoomToken (see its own `dmRootPolicy`). The default requires the root to be the verifying identity, which is right for a notice another device posted to me. A device reading its own notice holds a token rooted at the other participant, so only "either-participant" can pass there; it is safe because nothing about an own notice rests on the root rule, the device wrote it.
+   */
+  dmRootPolicy?: "self" | "either-participant";
 }
 /**
  * Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.

package/dist/domain/room.mjs

@@ -101,7 +101,8 @@ async function verifyRoomNotice(notice, options) {
 		clock: options.clock,
 		revocation: options.revocation,
 		expectedBearer: claims.poster,
-		roomPath: claims.room
+		roomPath: claims.room,
+		...options.dmRootPolicy !== void 0 ? { dmRootPolicy: options.dmRootPolicy } : {}
 	});
 	if (!tokenVerdict.ok) return {
 		ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",